Write data/logs to file using source HOSTNAME

#1 dproscino 4 years ago

Hello:

I have been working on setting up an intermediary SYSLOG Server to receive syslog events from various network devices as part of my Splunk deployment.
Please NOTE: This a WINDOWS 2019 Server environment.

I am a newbie to NXLog . I have been able to get a base configuration working to receive data on port 514. I can successfully write to a file but the only option that seems to work is to write to file using the source IP Address, but I want to write to a file using the source Hostname.

I am using the Community Edition and do not have access to use xm_resolver.

How can I receive syslog data and write that data to file using source HOSTNAME?

I have been researching and trying now for close to a month with no success. Any information / guidance would be greatly appreciated.

Thank you for your time. Regards, --Diane Proscino

Permalink

#2 manuel.munozDeactivated Nxlog ✓ 4 years ago

#1 dproscino

Hello: I have been working on setting up an intermediary SYSLOG Server to receive syslog events from various network devices as part of my Splunk deployment. Please NOTE: This a WINDOWS 2019 Server environment. I am a newbie to NXLog . I have been able to get a base configuration working to receive data on port 514. I can successfully write to a file but the only option that seems to work is to write to file using the source IP Address, but I want to write to a file using the source Hostname. I am using the Community Edition and do not have access to use xm_resolver. How can I receive syslog data and write that data to file using source HOSTNAME? I have been researching and trying now for close to a month with no success. Any information / guidance would be greatly appreciated. Thank you for your time. Regards, --Diane Proscino

Diane,

Maybe what you need is...

string hostname()
Return the hostname (short form).

string hostname_fqdn()
Return the FQDN hostname. This function will return the short form if the FQDN hostname cannot be determined.

Can you please paste here the config you are using?