I believe syslog-ng derives host ip address (Hostname if dns enabled) from source address from the ip header. However, since routers have multiple interfaces, is it typical to configure routers to send syslog messages from a configured src-address? I guess this is more of an operational question. thanks ramesh