Problem with Source field and FQDN

Graylog Central (peer support)
1

Im collecting dns, dhcp, event log form AD serwer an have problem with source field, dns and dhcp logs containt source field with out FQDN (Only hostname for example ad1), source field logs from event log it ok and containt hotname with FQDN for example ad1.local.corp, how to fix it ?

2

hej rob

how you ingest the data to Graylog? That is where you need to ajust your settings. Another option would be to correct that field with a processing pipeline. A rule would look like:

rule "set Diskstation hostname"
when
 has_field("source") AND contains(to_string($message.source), "DiskStation")
then
 set_field("source", "diskstation.lan");
end
3

I am using nxlog ,

<Extension gelf>
    Module xm_gelf
</Extension>
<Input in>
    # For windows vista/2008 and above use:
    Module    im_msvistalog  
    
    #zbieramy logi błędy, krytycze, oraz wybrane zdarzenia tu wpisac id
    Exec if not ($Severity == 'ERROR' or $Severity == 'CRITICAL' or $EventID IN (624, 630, 631, 634, 635, 638, 658, \
   662, 4624, 4625, 4720, 4726, 4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4740, 4741, 4742, 4743, 4754, \
   4755, 4756, 4757, 4758, 4764, 4767)) drop(); 
   
    # For windows 2003 and earlier use the following:
    #   Module      im_mseventlog
</Input>

<Input dhcp_log1>
    Module im_file
    #scieżka do pliku na 64bit
    File "C:\\Windows\\Sysnative\\dhcp\\DhcpSrvLog-*.log"
    #na 32 bit
    #File 'C:\Windows\System32\dhcp\DhcpSrvLog*.log'

    # Co ile czytamy domyslenie co 1 sekunde jak trzeba mnie to tu mozna to zmienic   
    #PollInterval 1
    SavePos True
    ReadFromLast True
    Recursive False
    RenameCheck True
    CloseWhenIdle True
</Input>

<Input dns_log1>
    Module  im_file
    #scieżka do pliku na 64bit
    File "C:\\Windows\\Sysnative\\dns\\dns.log"
    #na 32 bit
    #File 'C:\Windows\System32\dns\dns.log'
    # Co ile czytamy domyslenie co 1 sekunde jak trzeba mnie to tu mozna to zmienic   
    #PollInterval 1
    SavePos True
    CloseWhenIdle True
    InputType LineBased
    #skopiowanie lini z dns.log do message bez ucinania do 64 znaków
    Exec $short_message = $raw_event;
</Input>

<Output out> 
    Module      om_udp
    Host        192.168.1.231
    Port        6514
    OutputType  GELF
</Output>

<Route 1>
    Path        dhcp_log1, dns_log1 , in => out
</Route>
4

did you tried adding:

    Exec $Hostname = hostname_fqdn();

like suggested in the nxlog community?

https://nxlog.co/question/2212/nxlog-exec-hostname-hostnamefqdn-not-working

5

yes but this create field ‘hostname’ , does not overwrite source field

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.