search

crazytroy / eventlog-to-syslog

Automatically exported from code.google.com/p/eventlog-to-syslog
0 stars 0 forks source link

Incorrect hostname formatting #10

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago 
What steps will reproduce the problem?
1. Not sure, seems to be somewhat random
2. But, currently have several Windows 2003 servers exhibiting problem
3. And several, using the same exact install, that don't exhibit the problem

What is the expected output? What do you see instead?
   The expected hostname is "HOSTNAME", in the log message.  Instead, there seems to be an extra space, and the log message displays " HOSTNAME" in it's place, and I can't seem to get rsyslog to match the hostname correctly.  Sometimes the hostname appears correctly, such as in the service startup messages, like 'Eventlog to Syslog Service Started: ...', but most of the time, for example, when it's a 'Security:' message, the extra space/non-printing character appears in the message.

What version of the product are you using? On what operating system?
Evtsys version: 4.3, both 32-bit and 64-bit
OS: MS Win Server 2003 Enterprise Ed, SP2 (32-bit); MS Win Svr 2003 R2, 64-bit 
Std Ed, SP2;

Please provide any additional information below.

Original issue reported on code.google.com by gsgl...@gmail.com on 29 Jul 2010 at 6:43

GoogleCodeExporter commented 8 years ago 
That's interesting that it is not consistent. Do you notice them from a 
particular log or type of message in particular?

Original comment by sherwin....@gmail.com on 29 Jul 2010 at 8:28

GoogleCodeExporter commented 8 years ago 
I have rsyslog catching all logs, and then separating the messages into logs by 
hostname.  What I refer to as the 'startup' and 'evtsys warning' messages 
appear in the separated hostname logs, but all the logs that would actually 
appear in the Windows Event Logs have the extra space/hostname resolution 
problem.  

The problem may be by server OS; I have one Windows Server 2003 R2 Std 32-bit 
server, and it is the only one that is reporting entirely as expected.  Also, 
this server reports its hostname as 'hostname.domain.com'.  The other OS 
variants, 64-bit, and Enterprise, all seem to have this issue.  Also, they 
report their hostname as 'HOSTNAME' (all caps, no domain attached).

Hopefully this information is helpful to you.

Original comment by gsgl...@gmail.com on 30 Jul 2010 at 5:10

GoogleCodeExporter commented 8 years ago 
Ok, I think I have narrowed down the issue and resolved it. My preliminary 
testing shows the formatting to be occurring correctly. The format string was 
not being output correctly in certain instances. I have consolidated the string 
formatting process so it should now be consistent across OS and for the utility 
messages. Let me know if the issue still appears for you in 4.3.1. I have 
updated the repository and will be updating the download section later today.

I am unable to explain the difference you are seeing in 2003 R2 however. The 
hostname should mirror what you see in the %COMPUTERNAME% environment variable, 
so that may explain the addition of the domain, but it does not explain why it 
did not exhibit the extra space problem. Try out the new version and let me 
know if you see any additional issues.

Thanks,

Sherwin

Original comment by sherwin....@gmail.com on 5 Aug 2010 at 8:06