You want to use something other than %HOSTNAME%, see the list of
properties available at
<http://www.rsyslog.com/doc/v8-stable/configuration/properties.html>.
You might also want to set the hostname on the Cisco switch, search for
cisco ios set hostname with your favourite search engine.
BR,
- Simon
On Fri, 2018-02-16 at 16:56:12 -0500, John Ratliff wrote:
When my rsyslog server receives packets from our cisco switches,
instead of logging it with the hostname, it logs it with the IP
address. How can I get rsyslog to use the hostname instead?
This is my rsyslog.conf file.
module(load="imuxsock") # provides support for local system logging
module(load="imklog") # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
template(name="RemoteLogTemplate"
type="string"
string="/var/log/remote/%HOSTNAME%/%$year%/%syslogfacility-text%-%$year%%$month%%$day%.log")
ruleset(name="remote") {
*.* -?RemoteLogTemplate
}
# provides UDP syslog reception
module(load="imudp")
input(type="imudp"
port="514"
ruleset="remote")
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
*.=debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none -/var/log/messages
*.emerg :omusrmsg:*
Thanks.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.