Hello,
I recently upgraded a server from CentOS 6.2 to 6.3 I found a change in the behavior of rsyslog's configuration file that I found particularly interesting. The "$PreserveFQDN on" directive was not being recognized as the config remained unchanged during the upgrade. This incorrect behavior caused the host to syslog with only the host name and not it's fully qualified domain name.
** Has anyone else experienced this odd behavior? **
I did find a workaround [0] [1], but feel this behavior is a bug. Note the bugreport linked previously was for version 5.4.0 and reported in July 2010. If I make $PreserveFQDN the _first_ directive it syslogs with the FQDN otherwise the directive is ignored.
The official 6.2 mirror has rsyslog-4.6.2-12.el6.i686.rpm and 6.3 has rsyslog-5.8.10-2.el6.i686.rpm
For the record here's my output from `yum info rsyslog`: Name : rsyslog Arch : i686 Version : 5.8.10 Release : 2.el6 Size : 2.1 M Repo : installed
From repo : base
Summary : Enhanced system logging and kernel message trapping daemons URL : http://www.rsyslog.com/ License : (GPLv3+ and ASL 2.0) Description : Rsyslog is an enhanced, multi-threaded syslog daemon. It supports MySQL, : syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, : and fine grain output format control. It is compatible with stock sysklogd : and can be used as a drop-in replacement. Rsyslog is simple to set up, with : advanced features suitable for enterprise-class, encryption-protected syslog : relay chains.
I've not found other reports of this issue with CentOS 6.3 so far and there's no recent mention of this bug [yet] on the Rsyslog Bugzilla [2]. But the following ticket [3] submitted this past April makes me wonder.
Config Snippet: <config> #rsyslog v3 config file $PreserveFQDN on
# if you experience problems, check # http://www.rsyslog.com/troubleshoot for assistance
#### MODULES ####
$ModLoad imuxsock.so # provides support for local system logging (e.g. via logger command) $ModLoad imklog.so # provides kernel logging support (previously done by rklogd) #$ModLoad immark.so # provides --MARK-- message capability
# Provides UDP syslog reception #$ModLoad imudp.so #$UDPServerRun 514
# Provides TCP syslog reception #$ModLoad imtcp.so #$InputTCPServerRun 514
#### GLOBAL DIRECTIVES ####
# Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # # (BUG!) # FQDN must be the first directive or it is not honored # http://bugzilla.adiscon.com/show_bug.cgi?id=192 #$PreserveFQDN on ... omitted... </config>
[0] http://bugzilla.adiscon.com/show_bug.cgi?id=192 [1] http://serverfault.com/questions/274625/how-do-i-get-rsyslogd-to-log-a-serve... [2] http://bugzilla.adiscon.com/buglist.cgi?query_format=advanced&short_desc... [3] http://bugzilla.adiscon.com/show_bug.cgi?id=321
---~~.~~--- Mike // SilverTip257 //