I have an rsyslog server running on CentOS (CentOS Linux release 7.4.1708 (Core)). We use this mostly for network devices, mostly Cisco. I ship the hostname with all my logging events. My server creates a directory for each host, based on its hostname. However, many of the hostnames are not recognized, and the directory is creating using the devices IP address. I'm trying to figure out if I can adjust my settings to recognize these missing hostnames.
Here is an example of a properly functioning device:
This Cisco ASA is shipping the hostname directly after timestamp:
Sep 12 10:04:13 FIREWALL01 : %ASA-6-302016: Teardown UDP connection ...
Those ASA logs are thrown in a directory titled "FIREWALL01". This is the behavior I want.
This device is a Cisco ISR router. It is still including the hostname, but it comes later in the event log:
Sep 12 09:33:07 10.X.X.X 38174: ISRROUTER01: Sep 12 14:33:06.233: %BGP-5-ADJCHANGE: neighbor ...
In this example, I would expect rsyslog to throw these events in a directory titled "ISRROUTER01", however it is throwing them in a directory titled "10.X.X.X" instead.
Here's my current /etc/rsyslog.conf config file:
# Where to place auxiliary files $WorkDirectory /var/lib/rsyslog # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # File syncing capability is disabled by default. This feature is usually not required, # not useful and an extreme performance hit #$ActionFileEnableSync on # Turn off message reception via local log socket; # local messages are retrieved through imjournal now. $OmitLocalLogging on # File to store the position in the journal $IMJournalStateFile imjournal.state #### Templates #### # log every host in its own directory $template RemoteHost,"/var/log/syslog/%HOSTNAME%/%HOSTNAME%.log" # Local Logging $RuleSet local *.info;mail.none;authpriv.none;cron.none /var/log/messages authpriv.* /var/log/secure mail.* -/var/log/maillog cron.* /var/log/cron *.emerg :omusrmsg:* uucp,news.crit /var/log/spooler local7.* /var/log/boot.log # use the local RuleSet as default if not specified otherwise $DefaultRuleset local # Remote Logging $RuleSet remote *.* ?RemoteHost #### Listeners #### # bind rulesets to listeners $InputTCPServerBindRuleset remote $InputUDPServerBindRuleset remote # activate listeners $InputTCPServerRun 514 $UDPServerRun 514
So, does anyone have any ideas on config changes I could make to pick the hostname out of several different types of log files? Some type of template, maybe?
Thanks in advance!