ColinWebdesign
asked on
Syslog Server and Clients
I have installed Syslog-ng on a OpenBSD 3.4 Server. working.....
But i have one little problem:
My Syslog Server is in a Server room, 100 miles away from home
I have 2 OpenBSD Servers at home. Both servers are logging on the Syslog Server.
But i cannot find how to sepperate those two server. cause on the syslog server the host says both: home.domain.com
but one server has a hostname gw01.domain.com
and the other one gw02.domain.com
home.domain.com is the outside address of my dsl...
How can i tell the syslog-server that he must keep the local-hostname of the servers, not the outside addresses...
But i have one little problem:
My Syslog Server is in a Server room, 100 miles away from home
I have 2 OpenBSD Servers at home. Both servers are logging on the Syslog Server.
But i cannot find how to sepperate those two server. cause on the syslog server the host says both: home.domain.com
but one server has a hostname gw01.domain.com
and the other one gw02.domain.com
home.domain.com is the outside address of my dsl...
How can i tell the syslog-server that he must keep the local-hostname of the servers, not the outside addresses...
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Hi ColinWebdesign,
gheist is right in saying that you can't. However, it might still be possible to differentiate between the messages from these servers. To achieve this, you will have to modify the syslog server on atleast one machine to prefix an identifier/string to all messages that it logs.
It is a bit more work than simply modifying a configuration file but should not be too difficult/time consuming and is definitely a possibility. However, bear in mind that the modification is non-standard behavior and will serve in your specific scenario.
cheers
sunnycoder
gheist is right in saying that you can't. However, it might still be possible to differentiate between the messages from these servers. To achieve this, you will have to modify the syslog server on atleast one machine to prefix an identifier/string to all messages that it logs.
It is a bit more work than simply modifying a configuration file but should not be too difficult/time consuming and is definitely a possibility. However, bear in mind that the modification is non-standard behavior and will serve in your specific scenario.
cheers
sunnycoder
given limitation that all config is done _only_ on syslog server, your answer is completely wrong.
otherwise there should be mention of IPSEC from me.
otherwise there should be mention of IPSEC from me.
Hi gheist,
I could not see any such limitation stated in the question. I beleive that since messages are being forwarded to the syslog server, appropriate configuration would have been done on all three machines!! Moreover, the solution does not involve a change in the configuration.
Whatever the limitations of the solution, they have been very clearly outlined in my post. I do not see why you need to mention IPSEC in this scenario.
Simple thing is that at some point syslogd process on the home machines is writing the log string to a file/socket descriptor. All asker has to do is prefix a differntiating string to the logged message at that point.
An alternate mechanism will be to run a wrapper process on the home machine to listen to all log messages, prefix identifying string and then pass the message on to syslogd process. More work, but more portable too !!
Not as easy as changing a variable in config file and restarting the daemon but atleast a solution - tad bit better than impossible. ;-)
cheers!
sunnycoder
I could not see any such limitation stated in the question. I beleive that since messages are being forwarded to the syslog server, appropriate configuration would have been done on all three machines!! Moreover, the solution does not involve a change in the configuration.
Whatever the limitations of the solution, they have been very clearly outlined in my post. I do not see why you need to mention IPSEC in this scenario.
Simple thing is that at some point syslogd process on the home machines is writing the log string to a file/socket descriptor. All asker has to do is prefix a differntiating string to the logged message at that point.
An alternate mechanism will be to run a wrapper process on the home machine to listen to all log messages, prefix identifying string and then pass the message on to syslogd process. More work, but more portable too !!
Not as easy as changing a variable in config file and restarting the daemon but atleast a solution - tad bit better than impossible. ;-)
cheers!
sunnycoder
ASKER