syslog-ng and zabbix log

[karol]

Hi all,
currently I use syslog-ng to collect log messages from cisco devices. Everything goes into /var/log/cisco.log and zabbix transport text into frontend by log monitoring function. When I am interested on specyfic device I must put IP address and after this I can watch logs on interested machine. Is known solution how to add hostname from fronted and make search with hostname as a search key?

now:
Timestamp Local time Value
2014.Jun.01 06:33:08 Jun 1 06:33:02 10.156.2.XX 000452: Jun 1 04:33:01.707: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up

slolution:
2014.Jun.01 06:33:08 Jun 1 06:33:02 West-Station 000452: Jun 1 04:33:01.707: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up

[gleepwurp]

Hi Karol,

I'd guess you need to configure syslog-ng to resolve your hostnames... You would need to put in the IP-address/hostname association in /etc/hosts, and add the following in your syslog-ng.conf file:

# Resolve hostname locally - persist_only wants to resolve hostname locally
        use_dns(persist_only);
        dns_cache_hosts(/etc/hosts)

This should put in your resolved hostname instead of the IP address in your global log.

You can look here for additional details: http://www.googlux.com/syslog-ng_conf_server.html

Gleepwurp.