[rsyslog-notify] Forum Thread: Host information is missing while sending Oracle DB logs on - (Mode 'post')

[noreply at adiscon.com]

User: antonb 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26128#p26128

Message: 
----------
Host information is missing while sending Oracle DB logs on hp-ux to
log-server [ Edited ]
I have several HP-UX servers with Oracle 11G DB on them. Logs of both OS
and DB are sending through syslogd to centralized log-server (1.1.1.1),
which is running on Oracle Linux. The problem is that received logs from
Oracle DB doesn't contain hostname information, however when log is
generated on its source (hp-ux server) it has all the information. There
are no problem with OS logs.
I've tested same scenario on RHEL virtual machines and there it worked just
fine.

logs on source:
Oct 14 16:27:42 hostname Oracle Audit[7745]: LENGTH: "220" ---output
info---

logs on log-server:
Oct 14 16:27:42 Oracle Audit[7745]: LENGTH: "220" ---output info---

There are configuration files of both client and server:
[code:ptexufmw]HP-UX Server
cat /etc/syslog.conf# @(#)B.11.31_LR#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#mail.debug          /var/adm/syslog/mail.log#database logs
local1.warning      /var/adm/syslog/audit.log
local1.warning      @1.1.1.1
#os logs
*.info;mail.none        /var/adm/syslog/syslog.log
*.info;mail.none        @1.1.1.1
*.emerg         *
*.emerg         @1.1.1.1
*.alert         /dev/console
*.alert                 root
*.alert                 @1.1.1.1[/code:ptexufmw]

LogServer
[code:ptexufmw]# rsyslog v5 configuration file
# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html#
If you experience problems, see
http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

$ModLoad imuxsock # provides support for local system logging (e.g.
via logger command)

$ModLoad imklog   # provides kernel logging support (previously done by
rklogd)

#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception

$ModLoad imudp

$UDPServerRun 514

 # Provides TCP syslog reception

$ModLoad imtcp

$InputTCPServerRun 514


$ModLoad ommysql*.* :ommysql:localhost,Syslog,username,password


#### GLOBAL DIRECTIVES ####

# Use default timestamp format

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is
usually not required,
# not useful and an extreme performance hit

#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/

$IncludeConfig /etc/rsyslog.d/*.conf

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none               
/var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                 
-/var/log/maillog

# Log cron stuff
cron.*                                                     
/var/log/cron

# Everybody gets emergency messages 
*.emerg                                                
:omusrmsg:*

# Save news errors of level crit and higher in a special file. 
uucp,news.crit                                         
/var/log/spooler

# Save boot messages also to boot.log
local7.*                                            
/var/log/boot.log

# ### begin forwarding rule ###

# The statement between the begin ... end define a SINGLE
forwarding
# rule. They belong together, do NOT split them. If you create
multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.

#$WorkDirectory /var/lib/rsyslog # where to place spool files
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown    
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g.
192.168.0.1:514, port optional
#*.* @@remote-host:514
# 
### end of the forwarding rule ###

# A template to for higher precision timestamps + severity logging

$template
SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds%
%syslogtag%
%syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"

:programname, startswith, "spice-vdagent"  
/var/log/spice-vdagent.log;SpiceTmpl

$template TmplAuth,
"/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"

$template TmplMsg,
"/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"

authpriv.* ?TmplAuth

*.info,mail.none,authpriv.none,cron.none
?TmplMsg[/code:ptexufmw]

Can't figure out. Is it rsyslogd or syslog problem? 
Need your help :)