I use the following global options in my syslog-ng.conf file and don't have any information added to messages when they're forwarded from one syslog-ng server to another:
options { time_reopen (10);
log_fifo_size (10000);
long_hostnames (off);
use_dns (no);
use_fqdn (no);
create_dirs (no);
dir_perm (0755);
perm(0644);
chain_hostnames(no);
keep_hostname (yes);
flush_lines (0);
};
Also, does the relay server use a template to reformat the message? If so, I would remove that as well.
HTH,
Steve
----- Message d'origine -----
De: gatfi sami <pfegatfi.sami@gmail.com>
Date: Vendredi, 17 Avril 2009, 11:18
Objet: [syslog-ng] message source hostname not displayed relay's hostname displaied instedd
À: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu>
> hi
> i have syslog-ng 2.O.9-27 on sles11 32bite (SUSE Entreprise server 11) on 3 virtual machine
> i use the following syslog organisation
> a syslog client (read error log and sends them to a relay)
> the relay frorwords the message to a syslog-server
> The syslog server writes the messages in a pipe binde to a mysql database
> untill now everithing is working perfectly
> but
> in the syslog server i olways founf the relai host name ip adress
> i tried HOST_FROM in the template writing to the pipe it is always the same the relay's hostname
> destination d_mysql {
> pipe("/opt/topnet/mnt/mysql.pipe"
> template("INSERT INTO logs (host, facility, priority, level, tag, date,
> time, program, msg) VALUES ( '$HOST_FROM', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG',
> '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes));
> };
> imagine if i have aot of cilents with each one a diiferent error log i will see nothing but the relai's hostname
> need hepl here
> thks
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>