OneView syslog

[PeterWolfe]

What logger are you using for your consolidated logging?

The only short term workaround is to fix it the server-side. For eample, if using rsyslog as the consolidated logger, add a stanza for the appliance that changes the message to use the FQDN. For example:

 $template appliance1, "%TIMESTAMP% myappliance.example.com %syslogtag%%msg:::sp\
-if-no-1st-sp% %msg:::drop-last-lf%\n"
:hostname, isequal, "ci-005056bf4078" /var/log/messages;appliance1
& ~

There would be an equivalent technique for syslog-ng. It's not pretty, but could tide you over until a fix is avaialble. 

[adamcole]

There is no appliance name to modify off of server side as there is no appliance name in the logs.  

[adamcole]

OK - see my issue.  I was forwarding to a TCP port.  Updated to a UDP port and I am now seeing the logs with the ci-MAC format.  

[Darren_Matthews]

Finding similar, appreciate the short term workaround but is there a fix going in to make FQDN configurable (or default) for Audit Log Forwarding?  I'm assuming this has been captured and being fed in to the enhancement process?

Thanks

[BhaskarV]

Hi @Darren_Matthews 

The input has been taken.
This issue is being addressed in an upcoming / future patch / release.
Will update this thread once a publicly available release that contains the fix has been announced.

Regards,
Bhaskar