Balazs Scheidler wrote:
On Tue, 2005-05-10 at 10:12 -0600, Andrew Morris wrote:
One of the messages I'm getting (I'm sorting messages by hostname) is the "above message repeats n times" message, but syslog-ng is logging this under the host "above". Shouldn't syslog-ng decide what the hostname is by the ip address it is connected from? eg: host A connects, syslog-ng looks up the host by it's connecting ip address and uses that name resolution as the $HOST variable? (Note, in this case all hosts are in a local hosts file)
So, why would it ever write to the file "above"?
there is a separate macro for that, $HOST is the value as received in the original log message. always using the sender IP's resolved value would not be good for others using log relays.
So try using $HOST_FROM or $FULLHOST_FROM
Thanks! That's exactly what I've been looking for. You might want to add those to the 1.6 documentation...