4

I'm using CentOS 6.5 and rsyslogd:

Name        : rsyslog
Arch        : x86_64
Version     : 5.8.10
Release     : 8.el6

In rsyslog.d's conf file I have:

$PreserveFQDN on

and

$ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format

No matter what I do, apps like ntpd still log with the short hostname and not the fdqn. Even 'logger -t test this' still shows the short name.

   [root@web-01 ~]# hostname -s
   web-01
   [root@web-01 ~]# hostname -f
   web-01.productA.internal

Even explicitly setting the hostname in rsyslog doesn't seem to work.

Using the RSYSLOG_DebugFormat template

Logger

    [root@web-01 ~]# logger -t test 456
    [root@web-01 ~]# tail /var/log/messages
    Debug line with all properties:
    FROMHOST: 'web-01', fromhost-ip: '127.0.0.1', HOSTNAME: 'web-01', 
    PRI: 13, syslogtag 'test:', programname: 'test', APP-NAME: 'test', 
    PROCID: '', MSGID: '-', TIMESTAMP: 'Feb 20 21:50:12', 
    STRUCTURED-DATA: '-', msg: ' 456' escaped msg: ' 456'
    inputname: imuxsock rawmsg: '<13>Feb 20 21:50:12 test: 456'

Restart rsyslog

    Debug line with all properties:
    FROMHOST: 'web-01', fromhost-ip: '127.0.0.1', HOSTNAME:
    'web-01.productA.internal', PRI: 43,
    syslogtag 'rsyslogd-2026:', programname: 'rsyslogd-2026', APP-NAME: 
    'rsyslogd-2026', PROCID: '', MSGID: '-',
    TIMESTAMP: 'Feb 20 21:53:19', STRUCTURED-DATA: '-',

Why would those be different?

1
  • FWIW, I see this behavior when I'm using the RSYSLOG_ForwardFormat template. There are a handful of messages that always use the short name. I haven't isolated the problem yet, but I'm guessing that it's a bug in rsyslog v5.
    – jxstanford
    Oct 31, 2014 at 0:00

1 Answer 1

1

Take a look at the documentation about templates in rsyslog, titled: Templates.

The difference you're encountering is directly driven by the selection of RSYSLOG_SyslogProtocol23Format vs. RSYSLOG_DebugFormat formats.

It's not clear to me what the actual definition is for the RSYSLOG_DebugFormat template but according to this thread it doesn't appear to be defined anywhere in an official way.

   ss of thread

Suffice to say that the "Debug" template obviously includes the FQDN version of the hostname whereas the "Protocol123Format" does not.

2
  • the above example, both are using the debug format and the HOSTNAME is different for both. This is where I'm stuck at. I cant figure out why one line has the fqdn and the other does not. Feb 21, 2014 at 20:18
  • @ErikMathis - can you make this more clear in your Q? It's not obvious what you did to generate those logs.
    – slm
    Feb 21, 2014 at 20:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .