MonitorWare Knowledge Base

[jgregg]

In my template, I have %hostname% to make the host show up in the lines written to /var/log/messages. On the server in question, there are logs from remote hosts as well as ones that are locally generated. For the logs that are locally generated, sometimes the host field in the entries in /var/log/messages shows up as my actual host name, like "serverFoo", and other times it shows up as "localhost". Sometimes when rsyslog is behaving one way, a service restart will flip it to the other way. For locally generated log messages, what does rsyslog do to fill in the %hostname% property? How does it decide how to fill in this string, and why does it change its mind sometimes about how to do so?

I am running rsyslog 4.4.2.

-John

[jgregg]

I answered my own question, somewhat. It appears that rsyslog gets its idea of the hostname from the C routines gethostname() and gethostbyname(). If you google those in a Linux-savvy search site (http://www.google.com/linux or http://linux.die.net/man/2/gethostname) you should be able to tell what actual system files or properties those calls look at. The catch (correct me if I'm wrong) is that it looks like rsyslog only grabs this information on startup, so if you ever change your system's name (this is distro-specific, but hostname (shell command), /etc/hostname, /etc/sysconfig/network, sysctl kernel.hostname, etc.) you may have to restart rsyslogd for the new name to start showing up in your logs.

-John Gregg