<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">For me the original showed up in my junk folder for some reason, so thats probably where it is in yours.<div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class="">Ronald Fenner</div><div class="">Network Architect</div><div class="">Game Circus LLC.</div></div><div class=""><br class=""></div><div class=""><a href="mailto:rfenner@gamecircus.com" class="">rfenner@gamecircus.com</a></div></div></div></div>
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">On May 1, 2018, at 7:45 PM, Scheidler, Balázs <<a href="mailto:balazs.scheidler@balabit.com" class="">balazs.scheidler@balabit.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="auto" class="">Interesting that I saw this message the first time in your response, and not the original one.<div dir="auto" class=""><br class=""></div><div dir="auto" class="">Anyhow, to understand the problem we would need an exact byte-by-byte representation of what syslog-ng is receiving from the switch together with the configuration that is used to process it. A tcpdump or an "Incoming message" from syslog debug outout should work.</div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">We haven't intentionally changed the syslog parser as far as I remember.</div></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On May 1, 2018 22:50, "Clayton Dukes" <<a href="mailto:cdukes@logzilla.net" class="">cdukes@logzilla.net</a>> wrote:<br type="attribution" class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72" class="">
<div class="m_-7649788740190382892WordSection1"><p class="MsoNormal">Interesting! We’ve been getting a lot of support tickets for this very problem.<u class=""></u><u class=""></u></p><p class="MsoNormal">I can easily recreate the issue.<u class=""></u><u class=""></u></p><p class="MsoNormal"><u class=""></u> <u class=""></u></p><p class="MsoNormal">Balabit Team: is this a new bug?<u class=""></u><u class=""></u></p><p class="MsoNormal"><u class=""></u> <u class=""></u></p><p class="MsoNormal"><u class=""></u> <u class=""></u></p><p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif" class=""><u class=""></u> <u class=""></u></span></p>
<table class="m_-7649788740190382892MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="71%" style="width:71.0%;border-collapse:collapse">
<tbody class="">
<tr style="page-break-inside:avoid" class="">
<td width="5%" valign="top" style="width:5.0%;padding:0in 0in 0in 0in" class=""><p class="MsoNormal"><b class=""><span style="font-size:12.0pt;font-family:"Times New Roman",serif" class=""><span id="cid:image001.png@01D3E16C.840B3180"><image001.png></span><u class=""></u><u class=""></u></span></b></p>
</td>
<td width="1%" valign="top" style="width:1.06%;background:#f75f1c;padding:0in 0in 0in 0in" class=""><p class="MsoNormal"><b class=""><span style="font-size:12.0pt;font-family:"Times New Roman",serif" class=""><u class=""></u> <u class=""></u></span></b></p>
</td>
<td width="80%" valign="top" style="width:80.0%;padding:0in 5.4pt 0in 5.4pt" class=""><p class="MsoNormal"><b class=""><span style="font-size:12.0pt;font-family:"Times New Roman",serif" class="">Clayton Dukes</span></b><span style="font-size:12.0pt;font-family:"Times New Roman",serif" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif" class="">Founder & CEO<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:#afabab" class="">LogZilla Corporation<br class="">
<a href="https://maps.google.com/?q=2900+N.+Quinlan+Park+Rd&entry=gmail&source=g" class="">2900 N. Quinlan Park Rd</a>, B240-341<br class="">
Austin, TX, 78732<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:#afabab" class="">Tel: 936-4NetOps (463-8677) <u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:#afabab" class="">Web:
<a href="http://www.logzilla.net/" target="_blank" class=""><span style="color:#afabab" class="">www.logzilla.net</span></a><u class=""></u><u class=""></u></span></p><p class="MsoNormal"><a href="https://twitter.com/logzilla" target="_blank" class=""><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:windowtext;text-decoration:none" class=""><span id="cid:image002.png@01D3E16C.840B3180"><image002.png></span></span></a><a href="https://youtu.be/drg5wv_mgfA" target="_blank" class=""><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:windowtext;text-decoration:none" class=""><span id="cid:image003.png@01D3E16C.840B3180"><image003.png></span></span></a><a href="https://www.linkedin.com/in/lzcdukes/" target="_blank" class=""><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:windowtext;text-decoration:none" class=""><span id="cid:image004.png@01D3E16C.840B3180"><image004.png></span></span></a><span style="font-size:12.0pt;font-family:"Times New Roman",serif" class=""><u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif" class=""><u class=""></u> <u class=""></u></span></p><p class="MsoNormal"><i class=""><span style="font-size:12.0pt;font-family:"Times New Roman",serif" class="">For NetOps, By NetOps!<u class=""></u><u class=""></u></span></i></p>
</td>
</tr>
</tbody>
</table><p class="MsoNormal"><u class=""></u> <u class=""></u></p><p class="MsoNormal"><u class=""></u> <u class=""></u></p><p class="MsoNormal"><u class=""></u> <u class=""></u></p><p class="MsoNormal"><u class=""></u> <u class=""></u></p>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in" class=""><p class="MsoNormal"><b class=""><span style="font-size: 12pt;" class="">From: </span></b><span style="font-size: 12pt;" class="">syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank" class="">syslog-ng-bounces@lists.<wbr class="">balabit.hu</a>> on behalf of Joshua <<a href="mailto:aces621@yahoo.com" target="_blank" class="">aces621@yahoo.com</a>><br class="">
<b class="">Reply-To: </b>Joshua <<a href="mailto:aces621@yahoo.com" target="_blank" class="">aces621@yahoo.com</a>>, Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank" class="">syslog-ng@lists.balabit.hu</a>><br class="">
<b class="">Date: </b>Monday, April 30, 2018 at 7:09 PM<br class="">
<b class="">To: </b>"<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank" class="">syslog-ng@lists.balabit.hu</a>" <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank" class="">syslog-ng@lists.balabit.hu</a>><br class="">
<b class="">Subject: </b>[Suspected Spam] [syslog-ng] hostname not appearing correctly when receiving logs from switches<u class=""></u><u class=""></u></span></p>
</div>
<div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p>
</div>
<div class="">
<div class="">
<div class=""><p class="MsoNormal"><a name="m_-7649788740190382892__MailOriginalBody" class=""><span style="font-size:10.0pt;font-family:"Times New Roman",serif" class="">Hi All,<u class=""></u><u class=""></u></span></a></p>
</div>
<div class=""><p class="MsoNormal"><span class=""><span style="font-size:10.0pt;font-family:"Times New Roman",serif" class=""><u class=""></u> <u class=""></u></span></span></p>
</div>
<div class=""><p class="MsoNormal"><span class=""><span style="font-size:10.0pt;font-family:"Times New Roman",serif" class="">I am pretty new to syslog-ng but do have some basic knowledge. I have deployed syslog-ng v3.14 on a newly deployed Linux server
because syslog-ng v3.5 is working very well on another syslog server. <u class=""></u><u class=""></u></span></span></p>
</div>
<div class=""><p class="MsoNormal"><span class=""><span style="font-size:10.0pt;font-family:"Times New Roman",serif" class=""><u class=""></u> <u class=""></u></span></span></p>
</div>
<div class=""><p class="MsoNormal"><span class=""><span style="font-size:10.0pt;font-family:"Times New Roman",serif" class="">On this new deployment, the syslogs received from most of the servers are able to show IP/host, however, the syslogs from our
switches contains IP/host showing as ":" (colons). I copied the current working custom build .conf from another syslog server into our new server. Can someone help me figure out what I am missing? It is working for some components but not for switches. I tested
the same switch by sending syslog to another syslog server and the hostname is appearing but just not appearing on the new syslog server. The only difference between the two server is that one uses v3.5 (the working one) and the other uses syslog-ng v3.14.<u class=""></u><u class=""></u></span></span></p>
</div>
<div class=""><p class="MsoNormal"><span class=""><span style="font-size:10.0pt;font-family:"Times New Roman",serif" class=""><u class=""></u> <u class=""></u></span></span></p>
</div>
<div class=""><p class="MsoNormal"><span class=""><span style="font-size:10.0pt;font-family:"Times New Roman",serif" class="">I have set: "keep_hostname (yes)" but it still doesn't work.<u class=""></u><u class=""></u></span></span></p>
</div>
<div class=""><p class="MsoNormal"><span class=""><span style="font-size:10.0pt;font-family:"Times New Roman",serif" class=""><u class=""></u> <u class=""></u></span></span></p>
</div>
<div class=""><p class="MsoNormal"><span class=""><span style="font-size:10.0pt;font-family:"Times New Roman",serif" class="">Can someone please help? Am I missing something here?<u class=""></u><u class=""></u></span></span></p>
</div>
<div class=""><p class="MsoNormal"><span class=""><span style="font-size:10.0pt;font-family:"Times New Roman",serif" class=""><u class=""></u> <u class=""></u></span></span></p>
</div>
<div class=""><p class="MsoNormal"><span class=""><span style="font-size:10.0pt;font-family:"Times New Roman",serif" class="">Thanks<u class=""></u><u class=""></u></span></span></p>
</div>
<div class="">
<div class=""><p class="MsoNormal"><span class=""><em class=""><b class=""><u class=""><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#00407f" class="">Joshua Lai</span></u></b></em></span><span class=""><em class=""><b class=""><span style="font-size:10.0pt;color:#00407f" class=""> </span></b></em></span><span class=""></span><span style="font-size:10.0pt;font-family:"Arial",sans-serif" class=""><u class=""></u><u class=""></u></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote></div></div>
______________________________________________________________________________<br class="">Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" class="">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br class="">Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" class="">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br class="">FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" class="">http://www.balabit.com/wiki/syslog-ng-faq</a><br class=""><br class=""></div></blockquote></div><br class=""></div></body></html>