<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'><div dir='ltr'>
Hi,<BR>
<BR>
I'm having some problems properly storing messages received from AIX servers.<BR>
The format which they come in is like this:<BR>
<BR>
"Jul 5 19:30:59 Message forwarded from server2: su: from root to ..."<BR>
<BR>
According to a thread on this mailing list (<A href="https://lists.balabit.hu/pipermail/syslog-ng/2006-October/009372.html">https://lists.balabit.hu/pipermail/syslog-ng/2006-October/009372.html</A>), and if I understood correctly, this should be OK, and I should get the expected behaviour of replacing this with the form:<BR>
<BR>
"Jul 5 19:30:59 server2 su: from root to ..."<BR>
<BR>
However, what I get in the log is:<BR>
<BR>
"Jul 5 19:30:59 192.168.1.1 su: from root to ..."<BR>
<BR>
Where the 192.168.1.1 is the IP of the machine I got the message from and not the name of the server (server2 in this case).<BR>
<BR>
The issue here is that these messages belong to several machines which are sending their syslog messages to a NIM server which in turn forwards them to our syslog server, so the IP we end up with is not the machine's IP, but rather the NIM server IP, which is not what we need.<BR>
I tried parsing the message on arrival, but it doesn't work, I suppose it's because syslog-ng processes it before the parsers kick in.<BR>
<BR>
Is there a way to do this?<BR>
<BR>
TIA,<BR>
Ricardo.<BR> </div></body>
</html>