[rsyslog-notify] Forum Thread: Re: Host information is missing while sending Oracle DB logs - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26137#p26137

Message: 
----------
defining a template doesn't do anything, you have to change the output to
use the new template

so if you have your output as:

*.* :ommysql:localhost,Syslog,rsyslog,MYSQLPASSWORD

then no template you define will have any effexct on the data going to
mysql because you are using the template 'syslog,MYSQLPASSWORD' to change
this, define a new template and change the statement to use the new
template.

a template like you defined:

/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log

is not going to do what you want for putting data into mysql. the mysql
template generates a sql statement that mysql understands, a filename/path
like you define in this template is not going to be understood by mysql


according to the documentation, the default mysql template is:

$template tpl,"insert into SystemEvents (Message, Facility, FromHost,
Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values
('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%,
'%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%,
'%syslogtag%')",SQL

now, this template includes the hostname, so your problem that the hostname
is not getting into the database needs more explanation. what are you
getting into the database and what are you expecting/wanting to be there
instead?