You need keep_hostname(yes) on both the relay host and the central host. Regards, Drew -----Original Message----- From: William Rude [mailto:wrude@gardrail.com] Sent: Wednesday, March 24, 2004 3:20 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng]relay host address changes source hosts ip in message Greetings, I've been tasked to setup a syslog relay network from various pops to a centralized syslog server for insert into a database. The problem I'm running into is at the various pops, for example, lets call the first one POP-A. At POP-A, I have syslog-ng version 1.6.0rc4 setup to receive both udp and tcp syslog connections. It in turn, relays the syslog messages to the central server. When I look at the incoming data on the centralized server, the incoming data shows that the source host information is being re-written with the relay hosts ip. System stats are: Solaris 8 intel Syslog-ng 1.6.0rc4 POP-A configuration file follows: options { long_hostnames(off); use_dns(no); use_fqdn(no); dns_cache(no); check_hostname(yes); keep_hostname(no); chain_hostnames(no); # On Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(0); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(10240); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); create_dirs(yes); owner("root"); group("other"); perm(0600); use_time_recvd(yes); }; source src { # This is the source of syslog. # The default protocal port is 512 udp(); tcp(max-connections(1024)); }; source l_src { # This is the source of syslog. # This is internal messages on the local server internal(); sun-streams("/dev/log"); # This is internal messages on the local server }; destination syslogfile { file( "/var/log/syslogng/$HOST.log" ); udp("1.1.1.1"); }; filter priorityfilter { priority(debug,info,notice,warning,err,crit,alert,emerg); }; ############################################################### log { source(src); source(l_src); filter(priorityfilter); destination(syslogfile); }; ------------------------------------------------------ ------------------------------------------------------ ------------------------------------------------------ Server syslog-ng configuration follows: ------------------------------------------------------ ------------------------------------------------------ ------------------------------------------------------ options { long_hostnames(yes); use_dns(no); use_fqdn(no); dns_cache(no); # dns_cache_size(500); # dns_cache_expire(3600); # dns_cache_expire_failed(3600); # check_hostname(yes); keep_hostname(no); chain_hostnames(no); # On Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(0); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(10240); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); create_dirs(yes); owner("root"); group("other"); perm(0640); use_time_recvd(yes); }; ############################################################### source src { # This is the source of syslog. # The default protocal port is 512 udp(); # This is internal messages on the local server internal(); }; source l_src { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; destination syslogfile { file( "/var/log/syslogng/$YEAR_$MONTH_$DAY_$HOST.log" ); }; destination program1 { program( /path/to/uber/syslog/program.pl template ("¡$HOST¡$FACILITY¡$PRIORITY¡$LEVEL¡$TAG¡$FULLDATE¡$PROGRAM¡$MSG\n") template-escape(yes) ); }; filter priorityfilter { priority(debug,info,notice,warning,err,crit,alert,emerg); }; filter dropsyslog { not match("syslog-ng*"); }; ############################################################### log { source(src); filter(dropsyslog); filter(priorityfilter); destination(program1); destination(syslogfile); }; ############################################################### log { source(l_src); destination(program1); destination(syslogfile); }; _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html