logging

[Neodrac23]

I did not see a forum for logging.

I know someone out there has dealt with this before, I hope. I seam to be running into a wall.

Problem: I have about 20 routers and switches. All are logging back to a UNIX server using syslogd. I need to forward the messages to multiple hosts. However when i forward these messages, the UNIX server rewrites the hostname field, so when arrives at new host, all messages are reported coming from UNIX host.

Question: Is there a way to prevent syslogd from rewriting this field, or is there another approach i am not seeing?

 

[otc1966]

I do not think there is a way to prevent the Unix server from doing this, due to the fact that it has to append its hostname to the event it is forwarding. Not sure what/why you are forwarding them to other servers but there are 2 things you could do depending on what outcome you are looking for, you could just config the routers/switches to log to the other servers also. second you could cron a job to rcp the files over(if you are just looking to keep them on different servers) but if you are looking to say "trap" on those events not sure what you can do.

hope this helps.