[syslog-ng] SOLVED: Remote hosts logging as loopback, not hostname

Balazs Scheidler bazsi at balabit.hu
Tue Mar 14 00:27:21 CET 2006

On Mon, 2006-03-13 at 17:26 -0500, Rob Munsch wrote:
> oh SON of a SWITCH.
> So of course, i should not be stuffing clients' info into the same 
> template twice.  Doesn't seem to like that.  I assumed they'd have to 
> match, for some reason. 
> Removing the template() line from the client has allowed the info to 
> appear as one would expect.  Templates on client and server processes it 
> twice and it doesn't like it a little bit.
> may i humbly suggest that a note about template() being advisably 
> *server-only* in such an environment might be in order.    of course, 
> that may be  obvious to most people without having to be told; i can't 
> tell. 
> this would be the second "note to, for and by idiots" addition on nate's 
> faq to come from my addled brain.
> i'm going to go get some coffee.

Oh I see, you were changing the on-wire format using a template(),
although this might be useful for custom receivers it causes problems
for a 'normal' syslog daemon (like syslog-ng is behaving when it is a
server) I'll add a note to the documentation. This is what I added, is
that making it clear?

                  a format conforming to the default logfile format.
                  Specifies a template which defines the logformat to be
                  used in this destination. Macros are described in <xref
                  linkend="macros">this section</xref>. Please note that for
                  network destinations it might not be appropriate to change
                  the template as it changes the on-wire format of the
                  syslog protocol which might not be tolerated by stock
                  syslog receivers (like syslogd or syslog-ng itself). For
                  network destinations make sure the receiver can cope with
                  the custom format that you define.


More information about the syslog-ng mailing list