<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.16.1">
</HEAD>
<BODY LINK="#0000ff">
<BR>
On Thu, 2008-04-24 at 08:14 -0400, D'Souza, Alfred wrote:
<BLOCKQUOTE TYPE=CITE>
<FONT SIZE="2"><FONT COLOR="#000000">We have a bunch of servers whose applications write error/debug messages to 127.0.0.1 port 514. We want syslog-ng on each of the servers to forward the messages to a central logging server which also forwards the messages to zenoss running on the central logger server. The problem with our configuration (which I have copied here) is that no matter which server originates the message, they show up on the central server as originating from localhost – in both zenoss and in the /var/log files We want them to be shown as originating from the server that produced the messages. We can add a template on the central logger to log the messages as coming form $FROM_HOST, but while that solves the problem for the /var/log messages, zenoss still shows the messages as coming from localhost. Please help, we are new to using syslog-ng. We are using syslog-ng version 2.0.8 on Red Hat Linux.</FONT></FONT><BR>
<BR>
<FONT SIZE="2"><FONT COLOR="#000000"> </FONT></FONT>
</BLOCKQUOTE>
<PRE>
</PRE>
<PRE>
Do you have loghost defined? I've seen applications that will send there if defined instead of localhost. Maybe try
</PRE>
setting loghost to the server's hostname?
</BODY>
</HTML>