I have two urls one.example.com and two.example.com, is there a way in the syslog conf of capturing which URL was used to hit the server?

I need to modify a database filed based on this information.


I have a device which has busybox and syslogd installed. I am able to set an address on the device for the syslog, for example But I am not able to do anymore on the device other than this.

I have for example 100 devices, 50 are type A and 50 are type B. The issue is that when using in every device as the syslog server address, when receiving the device information on the remote syslog server I am unable to differentiate whether the device is type A or type B.

I have the following solution in mind, although there may be another way to achieve this. If I create two subdomains and point them to the same address, ie typea.example.com and typeb.example.com, then in theory in devices with a type A I will set the remote syslog address to typea.example.com:514 and for type B, typeb.example.com:514. Both of these subdomains will point to, therefore the syslog information is now being received by devices of Type A and devices of Type B.

I need to now figure out how to in the syslog.conf on the remote server, find out whether the information was received by a device using typea.example.com or typeb.example.com.

The server does not have apache installed etc, however, in PHP for example we can use $_SERVER and normally I would be able to retrieve this information from, $_SERVER['HTTP_HOST']. Is there any way to do this in the syslog.conf on the remote syslog server.

As mentioned this is one solution I have in mind and it may not be the only one. Syslog is new to me and I am currently wrapping my head around this. From what I understand rather than variable or parameters, syslog uses macros. None of the macros provided seem to give me the information I need.

I know I can also set the syslog by doing say

syslogd -R

Is there anyway here I can include further information for example:

syslogd -R type=a

Then I could say use $TYPE to get the value or alternatively add a custom header with the syslog.

As you can likely tell I am racking my brains for solutions and hitting brick walls. Any solution or docs that may point me in the right direction would be greatly appreciated.

Final point would be to mention I am also looking at redirecting the syslog info to a PHP script or a C (I'll say script but I know I am wrong) in order to vet the information there and then insert into the DB.

Quite simply I need a way to differentiate by type A or type B. Hopefully this clears matters up and these are not just the ramblings of a mad man.

  • More details are needed to answer this question. – wojtow Jun 15 '15 at 19:41
  • @wojtow I have added much more info. I am starting to understand the subject matter a bit more, so hopefully this will state clearly what I am trying to achieve. Thanks – The Humble Rat Jun 16 '15 at 7:17

The simplest way to accomplish what you want given the constraints that you've outlined in the original post and other comments, as well as the inherent limitations involved is to run two instances of the syslog server on the master syslog machine.

Run them on two different ports (say 30001 and 30002) and have them write their logs to two different files. Point the "type A" clients at port 30001 on the server, which logs entries into a typeA file and point the "type B" clients at port 30002 on the syslog server which logs entries into a typeB file.

The ports chosen above are arbitrary but don't conflict with other existing services. It also separates it from the normal syslog on the server so that your output isn't mixed with messages from that machine.

This assumes that you are running a full linux distribution on the server that has a full syslogd that can read its settings from a config file (rather than the limited syslogd built into busybox like on the clients). You also need to make sure the appropriate ports are open if a firewall is in use on the server. The exact details of how to do this on the server are dependent on the variant of syslog on the server and the server OS.

| improve this answer | |
  • Many thanks again for your input. This certainly seems like the only way to achieve what I need. Just to throw another spanner in the works, if for example I ended up with 100 types, this would presumably mean setting 100 different ports etc.I think I need to find another solution other than syslog. Obviously there are some limitations with syslog and the client devices which makes everything a bit more difficult. But I certainly accept your answer is the closest I will ever get with syslog. Many thanks again for your help and knowledge. – The Humble Rat Jun 18 '15 at 7:46
  • One final thought.... you could, at device boot, manually generate a message with the "logger" command announcing that this particular device is a typeA or whatever device. When processing the syslogs later, you could parse that and remember that the particular IP address is a typeA device (until you see a different message announcing that it is a different type of device if the IP address is later re-used). It would actually not be very hard to write a script to parse out the syslog files into typeA and typeB, etc logs based on this. – wojtow Jun 18 '15 at 22:51

The remote syslogd server should indicate a hostname (or IP address) as the next field immediately after the date and time. Here's a sample entry in a syslog file. The hostname/ip of the machine sending the entry in this case is "pizza"

Jun 16 15:45:01 pizza auth.info sshd[26861]: Failed password for user from port 59903 ssh2

Even though you are passing -R to each of the clients, that's the address they are all sending to. Each of the client devices should have it's own unique IP address... otherwise they can't exist on the same network. This unique address should be recorded in the remote syslog entries. You should be able to deduce which is which.

| improve this answer | |
  • I am getting an IP, but if the devices exist on a DHCP network and the lease time is low,potentially type A and type B could have shared an IP, similarly I am unable to use DNS to resolve a hostname from this IP as I can only assume that NAT adjusts the information.Therefore I would need to manipulate the data that gets sent somehow,or pick up on the url it was sent to.Also with the method above I would need to say map each IP to a group or map a hostname to a group which does not make it dynamic.Certain networks also use a single public IP for multiple clients. ie 2 servers behind one router. – The Humble Rat Jun 17 '15 at 10:52
  • A http server that serves two different sites from the same IP address can tell which site the request is for because the site name is provided as part of the request. The syslog protocol has no provision for this, nor does it have the provision for adding a tag of some sort like you want it to. I'll offer a different answer shortly. – wojtow Jun 17 '15 at 15:50
  • This is what I was afraid of and I am beginning to think syslog may not be possible for me. I have read that rsyslog allows you to edit the template, but unfortunately I am stuck with syslogd. I do appreciate all your help and advice so far, it is much appreciated, you certainly seem to have a better grip of what syslog is than I do. – The Humble Rat Jun 17 '15 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.