MonitorWare Knowledge Base

Hi there,

In rsyslog.conf I'd like to create a template which uses the IP address of my server rather than the hostname.

I don't want to hardcode my IP because that would be hard to maintain on thousands of unix servers eg:

$template Forwarder, "<%pri%> %timestamp% X.X.X.X %syslogtag% %msg%\n"

is there a variable like %fromhost-ip% that will do this? (I tried fromhost-ip but it only seems to resolve to 127.0.0.1).

(no, I can't resolve the hostname to an IP on the upstream syslog receiver).

eg, I get this:
Apr 28 17:06:20 bobserver.abc.com sshd[12545]: Received disconnect from 216.19.2.8: 11: Bye Bye [preauth]
or this:
Apr 28 17:06:20 127.0.0.1 sshd[12545]: Received disconnect from 216.19.2.8: 11: Bye Bye [preauth]

But I want this:

Apr 28 17:06:20 20.1.2.3 sshd[12545]: Received disconnect from 216.19.2.8: 11: Bye Bye [preauth]

• Pulling out your Hair?
• Wasting Time and Money?
• Deadline Approaching?

you cannot change any of the standard properties (including %fromhost% and %fromhost-ip%, but you can set a new template to use that replaces the hostname field with whatever you want (a constant or a variable)