We have a bunch of servers whose applications write error/debug messages to 127.0.0.1 port 514. We want syslog-ng on each of the servers to forward the messages to a central logging server which also forwards the messages to zenoss running on the central logger server. The problem with our configuration (which I have copied here) is that no matter which server originates the message, they show up on the central server as originating from localhost – in both zenoss and in the /var/log files We want them to be shown as originating from the server that produced the messages. We can add a template on the central logger to log the messages as coming form $FROM_HOST, but while that solves the problem for the /var/log messages, zenoss still shows the messages as coming from  localhost. Please help, we are new to using syslog-ng. We are using syslog-ng version 2.0.8 on Red Hat Linux.

 

Do you have loghost defined?  I've seen applications that will send there if defined instead of localhost.  Maybe try