[syslog-ng] ip vs hostname

[Peter Czanik]

Hello,

We have a single entry in the SCHEMAS to store login/logout sources:
usracct.device. Often only IP address appears in the logs, but sometimes
both hostname and IP address. I tend to use IP address in this case, as
that's something stable network wide, while a hostname could have only
local relevance (/etc/hosts or a local DNS server).
What do you think? Is IP enough, or we should also find a way to store
hostnames? Is there any situation, when hostnames matter?
Bye,

-- 
Peter Czanik (CzP) <czanik at balabit.hu>
BalaBit IT Security / syslog-ng upstream
http://czanik.blogs.balabit.com/