[rsyslog-notify] Forum Thread: How to display ip-address of relaying host - (Mode 'post')
noreply at adiscon.com
noreply at adiscon.com
Wed Nov 11 18:32:22 CET 2015
User: hohi888
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26132#p26132
Message:
----------
Versions:
Linux 3.6.11
rsyslogd 8.13.0
In have the following syslog configuration:
Host1 sends logs to Host2 where the rsyslog-configuration below is working.
Host2 receives the logs from Host1 via imudp and forwards them in another
subnet to Host3 (config see below).
[Host1, 10.254.254.101] -> [Host2, 10.254.254.100 > 192.168.136.224] ->
[Host3, 192.168.136.228]
Using the following lines in rsyslog.conf I see the address of relaying
Host2 - even for messages originally coming from Host1- what is what I
want:
$template RemoteFormat,"%msg%\n"
*.debug @192.168.136.228;RemoteFormat
Now at Host3:
Nov 11 17:47:21 192.168.136.224 this message comes from 10.254.254.101
But I would like to see address and hostname of Host1 at Host3 too.
Therefore I changed the configuration at Host2 as follows:
$template RemoteFormat,"%fromhost-ip% %hostname% %syslogtag%%msg%\n"
*.debug @192.168.136.228;RemoteFormat
Now at Host3:
Nov 11 17:49:28 10.254.254.101 iu_01 root: this message comes from
10.254.254.101
I see address and hostname of Host1 now, but the address of Host2 is gone!
I have not found any property name to insert the relaying IP-address of
Host2 again. How can I configure this?
rsyslogconf:
module(load="imuxsock")
module(load="imklog")
module(load="imudp")
input(type="imudp" port="514")
#$PreserveFQDN on <--- can't help us here!
$ActionFileDefaultTemplate RSYSLOG_SysklogdFileFormat
$template RemoteFormat,"%fromhost-ip% %hostname% %syslogtag%%msg%\n"
#$template RemoteFormat,"%msg%\n"
*.info /tmp/syslog.1
*.debug @192.168.136.228;RemoteFormat
More information about the rsyslog-notify
mailing list