Mailing List Archive

hostname
I'm having an issue with rsyslog v 8.39 on openSUSE. My config is very basic and I have defined

    $template FILENAME,"/var/log/daemon-%hostname%.log"

in the config to use the internal hostname variable as part of my filename as I'm receiving syslogs from other hosts as
well. This is happening on the central receiving rsyslog server.

When I reboot this server rsyslog logs to a file called daemon-%hostname%.log where the variable is replaced by the
content of the hostname command.

However when at night it is doing a restart as part of logrotate all of a sudden the hostname is different and kind of
reverts to an "alternative" hostname that I have defined for this host. I also have a python script that logs to rsyslog
and this one continues to use the "primary" hostname as defined just after the reboot.

When I call the hostname command it still shows me the "primary" hostname as expected.

This results now in 2 logfiles per day which I want to avoid.

It has always worked fine until a few weeks ago when I made some changes in dns, but I'm not 100% sure this is related
as I reverted the changes but the 2 filename issue did not disappear.

I have tried to find more information on this online but failed so far.

Can someone maybe point me into a direction where I have to search to understand what/why this is happening.

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: hostname [ In reply to ]
Well, firstly, you use a quite old version of rsyslog.

Secondly, you use a legacy configuration format. It is strongly
suggested that you use a RainerScript.

But to the point - you use a %hostname% property. Said property contains
"hostname from the message". So probably some of your syslog sources
send events with one hostname, and others with the other one.

On 08.04.2021 16:25, dutchguy69 via rsyslog wrote:

> I'm having an issue with rsyslog v 8.39 on openSUSE. My config is very basic and I have defined
>
>     $template FILENAME,"/var/log/daemon-%hostname%.log"
>
> in the config to use the internal hostname variable as part of my filename as I'm receiving syslogs from other hosts as
> well. This is happening on the central receiving rsyslog server.
>
> When I reboot this server rsyslog logs to a file called daemon-%hostname%.log where the variable is replaced by the
> content of the hostname command.
>
> However when at night it is doing a restart as part of logrotate all of a sudden the hostname is different and kind of
> reverts to an "alternative" hostname that I have defined for this host. I also have a python script that logs to rsyslog
> and this one continues to use the "primary" hostname as defined just after the reboot.
>
> When I call the hostname command it still shows me the "primary" hostname as expected.
>
> This results now in 2 logfiles per day which I want to avoid.
>
> It has always worked fine until a few weeks ago when I made some changes in dns, but I'm not 100% sure this is related
> as I reverted the changes but the 2 filename issue did not disappear.
>
> I have tried to find more information on this online but failed so far.
>
> Can someone maybe point me into a direction where I have to search to understand what/why this is happening.
>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.