<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="generator" content="Osso Notes">
<title></title></head>
<body>
<p>hi,
<br>
<br>the default hostname if otherwise unspecified is using this format if chain_hostnames() is enabled. this mimics the behaviour of chain_hostnames() when receiving the message locally. (the part before the slash is the host as it claimed itself to be, the part after the slash as it was resolved)
<br>
<br>I consider the chain_hostnames() functionality to be deprecated, it's not always logical how it behaves, but this is how it worked for the past decade.
<br>
<br>----- Original message -----
<br>> Normally when a syslog line is produced, the host has the format of
<br>>
<br>> {source}@{hostname}
<br>>
<br>> so when the log reaches my central server it looks like
<br>>
<br>> 2013-02-08T11:15:01-08:00
<br>> <a href="mailto:local@gpfs10.westgrid.uvic.ca">local@gpfs10.westgrid.uvic.ca</a>/chrysaor.westgrid.ca cron.info
<br>> CROND[20315]: ...
<br>>
<br>> but on this same host, I have a file source (different source
<br>> definition), its messages go to the same destination using a separate
<br>> log statement, but when they reach the central syslog server it looks
<br>> like
<br>>
<br>> 2013-02-08T11:11:35-08:00
<br>> gpfs10.westgrid.uvic.ca/gpfs10.westgrid.uvic.ca/chrysaor.westgrid.ca
<br>> local2.info mmfs: ...
<br>>
<br>> So it seems that the file source is populating the host with
<br>> {hostname}/{hostname}
<br>>
<br>> Was this intentional?
<br>>
<br>>
<br>> source mmfs { file("/var/adm/ras/mmfs.log.latest" log_fetch_limit(100)
<br>> program_override(mmfs) default-facility(local2) default-priority(info)
<br>> flags(no-parse) ); };
<br>>
<br>>
<br>> ______________________________________________________________________________
<br>> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
<br>> Documentation:
<br>> <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a> FAQ:
<br>> <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
<br>>
<br><br></p>
</body>
</html>