[syslog-ng] Syslog IP information is incorrect

[Kevin]

On 9/28/06, Tom Valdes <tom.valdes at gmail.com> wrote:
> Do you know of any programs which may do what I need?  If not, I'll create a
> seperate thread looking for something.

I'm using SNARE on MS-Windows machines to send event logs to syslog-ng.

The source IP does appear in the logs correctly.  The one annoying
"feature" is that fields within events are delimited by TABs, so my
logs look like this:

2006-09-28T12:16:07-0500 <user.info> 1.2.3.4 MSWinEventLog       1
  System    312     Thu Sep 28 12:16:37 2006        7036    Service
Control Manager Unknown User      N/A     Information     SOMEHOST
None            The WinHTTP Web Proxy Auto-Discovery Service service
entered the stopped state.   242

I have this destination set as template("$ISODATE
<$FACILITY.$PRIORITY> $HOST $MSG\n")

Kevin