[syslog-ng] rhost field

I am using syslog-ng for the first time. The initial setup is complete and appears to be working ok. However in my test environment, I am logging from a redhat desktop using syslog to a suse syslog-ng server. The output, after I deliberately input an incorrect password on my workstation doing a 'su', gets reported to the syslog-ng server as ....... Dec 23 17:50:12 suselog/suselog su(pam_unix)[13205]: authentication failure; logname=syss555 uid=500 euid=0 tty=pts/4 ruser=syss555 rhost= user=root How do I get it to display in the log the host(IP) the message came from? Thanks.