Interesting! We’ve been getting a lot of support tickets for this very problem.
I can easily recreate the issue.
Balabit Team: is this a new bug?
|
|
|
Clayton Dukes Founder & CEO LogZilla Corporation Tel: 936-4NetOps (463-8677) Web:
www.logzilla.net
For NetOps, By NetOps! |
From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Joshua <aces621@yahoo.com>
Reply-To: Joshua <aces621@yahoo.com>, Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu>
Date: Monday, April 30, 2018 at 7:09 PM
To: "syslog-ng@lists.balabit.hu" <syslog-ng@lists.balabit.hu>
Subject: [Suspected Spam] [syslog-ng] hostname not appearing correctly when receiving logs from switches
I am pretty new to syslog-ng but do have some basic knowledge. I have deployed syslog-ng v3.14 on a newly deployed Linux server
because syslog-ng v3.5 is working very well on another syslog server.
On this new deployment, the syslogs received from most of the servers are able to show IP/host, however, the syslogs from our
switches contains IP/host showing as ":" (colons). I copied the current working custom build .conf from another syslog server into our new server. Can someone help me figure out what I am missing? It is working for some components but not for switches. I tested
the same switch by sending syslog to another syslog server and the hostname is appearing but just not appearing on the new syslog server. The only difference between the two server is that one uses v3.5 (the working one) and the other uses syslog-ng v3.14.
I have set: "keep_hostname (yes)" but it still doesn't work.
Can someone please help? Am I missing something here?
Thanks
Joshua Lai