That's what i thought, and did from the start... No joy. Sorry. i should have been more explicit about that. just to be safe, i'd enabled keep_hostname on client and server. No effect. After that, i fiddled with various permutations of chain_hostnames on and off on client and/or server; since the $HOST macro expands to name of the originating host, as explicitly stated in the reference manual. nothing. aargh... then, since it was very late on Friday, i went home :). is there anything i could be doing with stunnel to mangle this process..? I have syslog dumping the remote messages to a plaintext file, and there too hosts show as loopback. Did this to see if maybe i was just screwing up the MySQL side of things; don't seem to be. So here's what the client, randomaccess, logs/dumps to a text file: randomaccess auth info info 26 2006-03-13T15:52:15-0500 su(pam_unix) su(pam_unix)[9942]: session opened for user root by (uid=500) now here's the funny part. here's a sample line, on the server, of what's coming over. Isis is the server, randomaccess is the remote client, they both are using the same template... but this same line on isis looks like: 127.0.0.1 user notice notice 0d 2006-03-13T15:52:55-0500 randomaccess randomaccess auth info info 26 2006-03-13T15:52:15-0500 su(pam_unix) su(pam_unix)[9942]: session opened for user root by (uid=500) How is the info getting scrambled around? Both files are using identical template statements, which is template("$HOST $FACILITY $PRIORITY $LEVEL $TAG $ISODATE $PROGRAM $MSG\n") and on the client it seems pretty clear. by the time we hit the server, however, it seems to think loopback is the host... and randomaccess is the program...? in addition, the entirety of this info - host thru isodate - becomes the $MSG. Very odd. How am i accomplishing this feat? Nathan Campi wrote:
Rob,
This is covered in the faq - it's even called something like "using stunnel, all hosts are logged as localhost". Use this:
options{ keep_hostname(yes); }; -- Nate Campi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
-- Rob Munsch Solutions For Progress IT