Well, firstly, you use a quite old version of rsyslog.
Secondly, you use a legacy configuration format. It is strongly suggested that you use a RainerScript.
But to the point - you use a %hostname% property. Said property contains "hostname from the message". So probably some of your syslog sources send events with one hostname, and others with the other one.
On 08.04.2021 16:25, dutchguy69 via rsyslog wrote:
I'm having an issue with rsyslog v 8.39 on openSUSE. My config is very basic and I have defined $template FILENAME,"/var/log/daemon-%hostname%.log" in the config to use the internal hostname variable as part of my filename as I'm receiving syslogs from other hosts as well. This is happening on the central receiving rsyslog server. When I reboot this server rsyslog logs to a file called daemon-%hostname%.log where the variable is replaced by the content of the hostname command. However when at night it is doing a restart as part of logrotate all of a sudden the hostname is different and kind of reverts to an "alternative" hostname that I have defined for this host. I also have a python script that logs to rsyslog and this one continues to use the "primary" hostname as defined just after the reboot. When I call the hostname command it still shows me the "primary" hostname as expected. This results now in 2 logfiles per day which I want to avoid. It has always worked fine until a few weeks ago when I made some changes in dns, but I'm not 100% sure this is related as I reverted the changes but the 2 filename issue did not disappear. I have tried to find more information on this online but failed so far. Can someone maybe point me into a direction where I have to search to understand what/why this is happening. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
