On Mon, May 13, 2013 at 12:11:22PM -0700, David Lang wrote: - On Mon, 13 May 2013, [email protected] wrote: - - >Howdy, - > - >I'm doing something wrong with my rsyslog.conf and I'm hoping someone can - >quickly point - >out where it is. - > - >I've got a stock CentOS /etc/rsyslog.conf and added - >/etc/rsyslog.d/00-papertrail.conf - > - >The 00-papertrail.conf looks like: - > - >--- - >$PreserveFQDN on - > - >$DefaultNetstreamDriverCAFile /etc/papertrail.crt - >$ActionSendStreamDriver gtls - >$ActionSendStreamDriverMode 1 - >$ActionSendStreamDriverAuthMode x509/name - > - >*.* @@logs.papertrailapp.com:${PORT} - >--- - > - > - >What I end up with is the following: - >--- - >May 13 17:51:21 db01.myhost.com kernel: imklog 5.8.10, log source = - >/proc/kmsg started. - >May 13 17:51:21 db01.myhost.com rsyslogd: [origin software="rsyslogd" - >swVersion="5.8.10" - >x-pid="16959" x-info="http://www.rsyslog.com";] start - >May 13 17:51:51 db01 postgres[17469]: [61-1] user=,db=,host= LOG: - >received SIGHUP, reloading - >configuration files - >May 13 17:51:51 db01 postgres[17469]: [62-1] user=,db=,host= LOG: - >parameter "max_connections" cannot be - >changed without restarting the server - >May 13 17:51:51 db01 postgres[17469]: [63-1] user=,db=,host= LOG: - >configuration file - >"/db/pg/postgresql.conf" contains errors; unaffected changes were applied - >--- - > - > - >You see that kernel and rsyslog are logging with FQDN where postgres is - >logging with just - >the hostname. - > - >I'd like to have postgres line have the hostname, but I'm not sure where - >to make that happen. - > - >Normally I have a 2nd file /etc/rsyslog.d/10-postgres.conf, which I've - >removed for debugging purposes. - >--- - >$FileGroup postgres - >local0.* /var/log/postgres - >$FileGroup adm - >!local0.* /var/log/messages - >!local0.* /var/log/syslog - >--- - > - >I've tried peppering that file with $PreserveFQDN on but not no avail. - > - >Any help would be greatly appreciated. - - The problem you are running into is that the old syslog RFC says that this - should be the short hostname, not the FQDN. Postgres is following that RFC. - The "new" (2009) RFC encourages the FQDN, but almost nothing has changed to - use that new format. - - I don't think there is anything you can do without modifying either - postgres, or more likely glibc to fix this as a generic problem - - You can change your rsyslog config to use a different template where you - hard-code the hostname field instead of passing on what the application - sends you. - - David Lang
Ah, ok that makes sense. The template seems like it will do the trick, thanks for the tip! Dave _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
