Rsyslog Not Recognizing Some Hostnames

Question

I have an rsyslog server running on CentOS (CentOS Linux release 7.4.1708 (Core)). We use this mostly for network devices, mostly Cisco. I ship the hostname with all my logging events. My server creates a directory for each host, based on its hostname. However, many of the hostnames are not recognized, and the directory is creating using the devices IP address. I'm trying to figure out if I can adjust my settings to recognize these missing hostnames.

Here is an example of a properly functioning device:

This Cisco ASA is shipping the hostname directly after timestamp:

Sep 12 10:04:13 FIREWALL01 : %ASA-6-302016: Teardown UDP connection ...

Those ASA logs are thrown in a directory titled "FIREWALL01". This is the behavior I want.

Incorrect Behavior:

This device is a Cisco ISR router. It is still including the hostname, but it comes later in the event log:

Sep 12 09:33:07 10.X.X.X 38174: ISRROUTER01: Sep 12 14:33:06.233: %BGP-5-ADJCHANGE: neighbor ...

In this example, I would expect rsyslog to throw these events in a directory titled "ISRROUTER01", however it is throwing them in a directory titled "10.X.X.X" instead.

Current Configuration:

Here's my current /etc/rsyslog.conf config file:

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state

####  Templates ####

# log every host in its own directory
$template RemoteHost,"/var/log/syslog/%HOSTNAME%/%HOSTNAME%.log"

# Local Logging
$RuleSet local
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log

# use the local RuleSet as default if not specified otherwise
$DefaultRuleset local

# Remote Logging
$RuleSet remote
*.* ?RemoteHost

####  Listeners ####

# bind rulesets to listeners
$InputTCPServerBindRuleset remote
$InputUDPServerBindRuleset remote

# activate listeners
$InputTCPServerRun 514
$UDPServerRun 514

So, does anyone have any ideas on config changes I could make to pick the hostname out of several different types of log files? Some type of template, maybe?

Thanks in advance!

Answer 1

I had similar issue with my rsyslog server. I am collecting syslog messages from many devices Linux box, Cisco and MikroTik devices and so on. It appears that hostnames of networking devices do not get resolved properly and they appear with their IP address or another names like _gateway for example.

What I have come up is to put all monitored host in /etc/hosts on the rsyslog server and the issue got resolved. I personally run a local DNS server that achieves basically the same.