I have an rsyslog server running on CentOS (CentOS Linux release 7.4.1708 (Core)). We use this mostly for network devices, mostly Cisco. I ship the hostname with all my logging events. My server creates a directory for each host, based on its hostname. However, many of the hostnames are not recognized, and the directory is creating using the devices IP address. I'm trying to figure out if I can adjust my settings to recognize these missing hostnames.

Here is an example of a properly functioning device:

This Cisco ASA is shipping the hostname directly after timestamp:

Sep 12 10:04:13 FIREWALL01 : %ASA-6-302016: Teardown UDP connection ...

Those ASA logs are thrown in a directory titled "FIREWALL01". This is the behavior I want.

Incorrect Behavior:

This device is a Cisco ISR router. It is still including the hostname, but it comes later in the event log:

Sep 12 09:33:07 10.X.X.X 38174: ISRROUTER01: Sep 12 14:33:06.233: %BGP-5-ADJCHANGE: neighbor ...

In this example, I would expect rsyslog to throw these events in a directory titled "ISRROUTER01", however it is throwing them in a directory titled "10.X.X.X" instead.

Current Configuration:

Here's my current /etc/rsyslog.conf config file:

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state

####  Templates ####

# log every host in its own directory
$template RemoteHost,"/var/log/syslog/%HOSTNAME%/%HOSTNAME%.log"

# Local Logging
$RuleSet local
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log

# use the local RuleSet as default if not specified otherwise
$DefaultRuleset local

# Remote Logging
$RuleSet remote
*.* ?RemoteHost

####  Listeners ####

# bind rulesets to listeners
$InputTCPServerBindRuleset remote
$InputUDPServerBindRuleset remote

# activate listeners
$InputTCPServerRun 514
$UDPServerRun 514

So, does anyone have any ideas on config changes I could make to pick the hostname out of several different types of log files? Some type of template, maybe?

Thanks in advance!

  • Usually when I see this it is the client that is behaving in the undesired manner, not the syslog server. You can capture some packets in wireshark to see what is actually going on. – Michael Hampton Sep 12 '19 at 16:36
  • rsyslog has a special parser for cisco "syslog" format. I dont know if it applies, nor how to use it though. Alternatively, you can try extracting the field youself as in this answer to something similar. – meuh Sep 12 '19 at 16:45
  • Hmm, that pmciscoios parser looks interesting. I think I'm going to play around with that and see how thing work out. I first need to make sure that ALL my devices are sending their hostname as the origin. – Jake Sep 12 '19 at 18:00

I had similar issue with my rsyslog server. I am collecting syslog messages from many devices Linux box, Cisco and MikroTik devices and so on. It appears that hostnames of networking devices do not get resolved properly and they appear with their IP address or another names like _gateway for example.

What I have come up is to put all monitored host in /etc/hosts on the rsyslog server and the issue got resolved. I personally run a local DNS server that achieves basically the same.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.