<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">That is what you get when you set
keep_hostname(yes)<br>
<br>
The first IP address is the one placed into the message (on the
wire) by the source device.<br>
<br>
The second one is added by the local/receiving syslog-ng system.
If you enabled the DNS for this, you would get the locally
resolved DNS name for that IP.<br>
<br>
Evan.<br>
<br>
On 06/08/2017 11:04 AM, Scot wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAOxbc8EnS9cZwz=5mUvug3swgHikhMebxmJF932iv6PV09HM+A@mail.gmail.com">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div dir="ltr">
<div>I seem to be getting a duplicate host header in my udp
syslog input where the IP is printed twice. </div>
<div><br>
</div>
<div>IP/IP any ideas where it comes from ? </div>
<div><br>
</div>
<div><br>
</div>
<div>Same result for either of these. </div>
<div>
<div>#source s_net_udp {udp(ip(0.0.0.0) port(514)
keep_hostname(yes) so_rcvbuf(262142));};</div>
<div>#source s_net_udp {syslog(ip(10.189.252.62)
port(514) transport("udp") flags(no-hostname)
so_rcvbuf(262142));};</div>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Jun 8 13:55:21 <b><a
href="http://192.168.10.10/192.168.10.10"
moz-do-not-send="true">192.168.10.10/192.168.10.10</a> </b> fw-aplha
%ASA-4-106 ..............</div>
<div><br>
</div>
</div>
</blockquote>
<br>
</body>
</html>