Guys<br><br>I'm trying to log to a loadbalanced VIP. It seems to work ok except that the loadbalancer uses SNAT so I loose my source IP.<br>This means I cannot use dns or even the source ip to get the source host as all logs appear to come from the same source (the loadbalancer).<br>
This means I have no choice but to rely on the hostname field which works about 98% of the time but some stuff like Dell OpenManage skips the hostname field.<br clear="all">So I'd get logs like this on host "cage" f.e.<br>
<br>Aug 16 21:47:22 Server Administrator: Storage Service EventID: 2242 The Patrol Read has started.: Controller 0 (PERC 5/i Integrated)<br><br>I fixed that by telling the syslog-ng client to force itself to figure out a proper hostname and now the log looks like this<br>
<br>Aug 17 13:51:10 cage Administrator[]: Instrumentation Service EventID: 1000 Server Administrator starting<br><br>I thought syslog-ng inserts the hostname but by the looks of it it simply replaces whatever is in the expected field with the hostname it has just figured out.<br>
As you can see it overwrote the entry "Server".<br>No biggie in the above case but what if this field contained valuable information ? I'd loose that.<br>Any way to squeeze in the hostname so to speak ?<br>
<br>
<br>-- <br>stucky<br>