Nginx only sends hostname to syslog.

[B.R.]

Correct me if I am wrong, since I probably will.

>From what I read
<https://www.gnu.org/software/libc/manual/html_node/Host-Identification.html>,
'host name' aka name of the host is a FQDN in the hostname.domain format (
domain being able to have n level-s).
Thus, it seems that setting a FQDN as hostname is wrong, since resolving
the FQDN needs querying hostname against hosts
<http://serverfault.com/questions/490825/how-to-set-the-domain-name-on-gnu-linux>
.

I am not quite sure that the standard then allow you to set more than 1
level in the hostname file.
Since nginx is using the hostname when sending logs to syslog, it does not
seem you can get the FQDN through the standard settings. I could not find
any variable containing the FQDN in the docs either.

​Maybe someone w/ greater knowledge could give us a hand here.​
---
*B. R.*

On Tue, Feb 7, 2017 at 11:37 AM, Kai Stian Olstad <nginx+list at olstad.com>
wrote:

> On 03.02.2017 13:58, Maxim Dounin wrote:
>
>> Hello!
>>
>> On Fri, Feb 03, 2017 at 01:17:30PM +0100, Kai Stian Olstad wrote:
>>
>> To get the post data from Kibana I use Nginx as a proxy and have the
>>> following log format,
>>>
>>>    log_format audit '$time_iso8601 "$remote_user" "$request_uri"
>>> "$request_body"';
>>>
>>>
>>> and to send the log to syslog I use the following.
>>>
>>>    access_log syslog:server=192.168.1.1,tag=audit audit;
>>>
>>>
>>> But Nginx only sends hostname to syslog server, is it possible to
>>> configure Nginx to send fully qualified domain name?
>>>
>>
>> Much like for the $hostname variable, for syslog logging nginx
>> uses whatever is returned by the gethostname() call.  It's up to
>> you to configure fully qualified domain name as a hostname of a
>> particular server.
>>
>
> Thank you for the answer.
>
> The challenge is that in Debian hostname should only be the name and not
> the FQDN.
> https://www.debian.org/doc/manuals/debian-reference/ch03.en.
> html#_the_hostname
>
> When I set the hostname to FQDN, Nginx do log with the FQDN, but this
> break other things that relay on hostname only be name and not FQDN.
>
> If it's not possible to configure this in Nginx I would need to find a
> workaround.
> One way could be to make Nginx log to file and rsyslog read that file.
>
> Is that my only way?
>
> --
> Kai Stian Olstad
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20170208/2044571f/attachment.html>