$fromhost is the result of a name lookup of the IP of the connection, it is
always the full result of that lookup (which will normally be a FQDN from DNS
David Lang
On Fri, 23 Feb 2024, Frank Morawietz via rsyslog wrote:
Thanks for your reply, Mariusz.
Also remember that fromhost and fromhost-ip are from the _connection_.
Hostname is the value from the message (might be completely bonkers if
the source doesn't follow standards).
This is exactly why I switched to FROMHOST. To much messages with junk instead
of the hostname.
You could also just do your own field based on the $fromhost value, just
split at first dot.
set $.loghost=field($hostname,46,1);
Then you can use the $.loghost variable in your template.
Got it. I already tried this adaption of my template and it's looking like I
wanted now!
Best regards,
Frank
P.S.: So the global option PreserveFQDN is not used on the receiving server?
--
Frank Morawietz
IT Systems Administrator Global Computational Chemistry & Biology
Healthcare | Discovery Development Technologies
Merck Healthcare KGaA | Frankfurter Str. 250 | Postcode: D050/902 | 64293
Darmstadt | Germany
This message and any attachment are confidential and may be privileged or
otherwise protected from disclosure. If you are not the intended recipient, you
must not copy this message or attachment or disclose the contents to any other
person. If you have received this transmission in error, please notify the
sender immediately and delete the message and any attachment from your system.
Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept
liability for any omissions or errors in this message which may arise as a
result of E-Mail-transmission or for damages resulting from any unauthorized
changes of the content of this message and any attachment thereto. Merck KGaA,
Darmstadt, Germany and any of its subsidiaries do not guarantee that this
message is free of viruses and does not accept liability for any damages caused
by any virus transmitted therewith.
Click
merckgroup.com/disclaimer<https://www.merckgroup.com/en/legal-disclaimer/mail-disclaimer.html>
to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak
versions of this disclaimer.
Please find our Privacy Statement information by clicking here:
merckgroup.com/privacy-statements-by-location<https://www.merckgroup.com/en/privacy-statement/privacy-statements-by-location.html>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
