Mailing List Archive: Controlling Hostname

Controlling Hostname

Mar 23, 2022, 11:08 AM

Post #1 of 5 (404 views)

I have several Linux instances in an Amazon VPC. They send UDP 514 to a singular free tier ubuntu server running rsyslog.
It aggregates all incoming messages and sends them over TLS to a primary log server running mysql and Loganalyzer on it.
Amazon makes controlling the hostname necessary because most hostnames look something like ip-10-0-99-199.
I was thinking maybe there was a way I could force the host that is originating a syslog message send it's message as an "IP address" versus the hostname.
If that were true, I could likely set any name I wanted in the /etc/hosts on the primary server and then primary server could just resolve the hostname on the primary server. Is that possible? If so how would I accomplish that?
Thanks in advance,CB
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: Controlling Hostname [ In reply to ]

rsyslog at lists

Mar 23, 2022, 12:44 PM

Post #2 of 5 (404 views)

Permalink

create a template that has whatever text you want in the hostname field and then
use that when sending a message

on the receiving side (the relay), you can look at fromhost-ip or fromhost and
then use that in a template while relaying it

David Lang

On Wed, 23 Mar 2022, Chris via rsyslog wrote:

> Date: Wed, 23 Mar 2022 18:08:10 +0000 (UTC)
> From: Chris via rsyslog <rsyslog@lists.adiscon.com>
> To: "rsyslog@lists.adiscon.com" <rsyslog@lists.adiscon.com>
> Cc: Chris <uni8600@yahoo.com>
> Subject: [rsyslog] Controlling Hostname
>
> I have several Linux instances in an Amazon VPC. They send UDP 514 to a singular free tier ubuntu server running rsyslog.
> It aggregates all incoming messages and sends them over TLS to a primary log server running mysql and Loganalyzer on it.
> Amazon makes controlling the hostname necessary because most hostnames look something like ip-10-0-99-199.
> I was thinking maybe there was a way I could force the host that is originating a syslog message send it's message as an "IP address" versus the hostname.
> If that were true, I could likely set any name I wanted in the /etc/hosts on the primary server and then primary server could just resolve the hostname on the primary server. Is that possible? If so how would I accomplish that?
> Thanks in advance,CB
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: Controlling Hostname [ In reply to ]

rsyslog at lists

Mar 23, 2022, 1:05 PM

Post #3 of 5 (404 views)

Permalink

Thank you for your response, I just found that there's likely a more elegant solution that requires less configuration.
There's an AWS config file that allows the dhcp EC2 instances to "preserve hostname".
I'll try that before I try to tackle the template approach. I can provide a link to that AWS guidance if anyone happens to be interested.Thanks again David.

On Wednesday, March 23, 2022, 03:44:14 PM EDT, David Lang <david@lang.hm> wrote:

create a template that has whatever text you want in the hostname field and then
use that when sending a message

on the receiving side (the relay), you can look at fromhost-ip or fromhost and
then use that in a template while relaying it

David Lang

On Wed, 23 Mar 2022, Chris via rsyslog wrote:

> Date: Wed, 23 Mar 2022 18:08:10 +0000 (UTC)
> From: Chris via rsyslog <rsyslog@lists.adiscon.com>
> To: "rsyslog@lists.adiscon.com" <rsyslog@lists.adiscon.com>
> Cc: Chris <uni8600@yahoo.com>
> Subject: [rsyslog] Controlling Hostname
>
> I have several Linux instances in an Amazon VPC. They send UDP 514 to a singular free tier ubuntu server running rsyslog.
> It aggregates all incoming messages and sends them over TLS to a primary log server running mysql and Loganalyzer on it.
> Amazon makes controlling the hostname necessary because most hostnames look something like ip-10-0-99-199.
> I was thinking maybe there was a way I could force the host that is originating a syslog message send it's message as an "IP address" versus the hostname.
> If that were true, I could likely set any name I wanted in the /etc/hosts on the primary server and then primary server could just resolve the hostname on the primary server. Is that possible? If so how would I accomplish that?
> Thanks in advance,CB
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: Controlling Hostname [ In reply to ]

rsyslog at lists

Mar 23, 2022, 1:11 PM

Post #4 of 5 (404 views)

Permalink

managing the hostname in the AWS instance is far better. I don't know the
details, but there is some ability to run a config script at startup time, you
could have that set the hostname (say something like 'function-count') and get
more value from the hostname

David Lang
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: Controlling Hostname [ In reply to ]

rsyslog at lists

Mar 23, 2022, 1:16 PM

Post #5 of 5 (404 views)

Permalink

Apologies if this is noise to the list, but I thought maybe someone else may find it interesting.
Change the hostname of your Amazon Linux instance - Amazon Elastic Compute Cloud

|
|
| |
Change the hostname of your Amazon Linux instance - Amazon Elastic Compu...

Set the hostname for your Amazon Linux instance using a dynamic DNS provider.
|

|

|

On Wednesday, March 23, 2022, 04:11:37 PM EDT, David Lang <david@lang.hm> wrote:

managing the hostname in the AWS instance is far better. I don't know the
details, but there is some ability to run a config script at startup time, you
could have that set the hostname (say something like 'function-count') and get
more value from the hostname

David Lang

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.