Depending how how your syslog-ng file is set up and assuming that the syslog data received is only IP address, I would make sure your DNS is setup correctly. Make sure all hosts have both forward and reverse entries in your DNS servers. That's how my implemenation is working. As long as my host have a reverse entry in DNS, syslog-ng is logging by name.
<br><br>Chris<br><br><br><div><span class="gmail_quote">On 10/4/06, <b class="gmail_sendername">Russell Fulton</b> <<a href="mailto:r.fulton@auckland.ac.nz">r.fulton@auckland.ac.nz</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
if the records received by syslog-ng contain the host name it will use<br>this by default. The answer my lie in how you configure syslog on the<br>hosts themselves. From memory syslog-ng uses the host name info in the<br>
packets by default.<br><br>Russell<br><br>Istvan Szukacs wrote:<br>> Hi!<br>><br>> I would like to log several computer which are behind nat. The problem<br>> is i cannot find the right metod to log by the hostname not by the ip
<br>> reverse name from where the packets come.<br>><br>> But i got this:<br>><br>> Oct 1 02:34:27 external ip/external ip<br>><br>> Is there a possibility to devide the logs by the original hostname?
<br>><br>><br>> thx<br>> _______________________________________________<br>> syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br>> <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>> Frequently asked questions at <a href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a><br>><br>_______________________________________________
<br>syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br><a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
<br>Frequently asked questions at <a href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a><br><br></blockquote></div><br>