-
Title
Local SSB Hostname Showing as SSB1 or SSB2 -
Description
When collecting local and internal logs from the Syslog-ng Store Box (SSB) the hostname shows as SSB1 or SSB2 instead of the actual hostname designated for the SSB. -
Cause
The boot firmware's hostname is SSB1 or SSB2, if in an HA pair, this is expected behavior. -
Resolution
Resolution:
Currently there is an enhancement request submitted and accepted to change the SSB1 and SSB2 hostnames to the correctly designated hostname set for the SSB. Please continue to monitor release notes for when this feature is implemented.Workaround:
A rewrite rule can be created to rewrite the hostname(s) correctly by following the steps below:
Please start by logging in to the WebUI and navigate to Log > Paths. Once there, find the path where the local logs are defined and expand this option.
In the Before Message Processing section add the following:
In message part: HOST
Find: SSB1
Replace with: SSB1_HOSTNAME_HERE
In message part: HOST
Find: SSB2
Replace with: SSB2_HOSTNAME_HERE
An example of this would look like:
In message part: HOST
Find: SSB1
Replace with: SSB01.ad.domain.com
In message part: HOST
Find: SSB2
Replace with: SSB02.ad.domain.com -
Additional Information
Using the ${HOST} macro as the replace with, does not change the hostname correctly, the correct hostname must be statically defined as the ${HOST} will return either SSB1 or SSB2.