'[syslog-ng] Problem with hostnames (keep_hostname(no);)'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       syslog-ng
Subject:    [syslog-ng] Problem with hostnames (keep_hostname(no);)
From:       "Dukes Clayton" <Clayton.Dukes () HCAhealthcare ! com>
Date:       2006-08-17 15:03:32
Message-ID: 779EEFE000FB9E4BB6F6B66B84A7563B05B8A4EE () NASEV02 ! hca ! corpad ! net
[Download RAW message or body]

--===============1414474354==
Content-class: urn:content-classes:message
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_001_01C6C20E.4E0BE10A"

This is a multi-part message in MIME format.

Hiya folks,
Here's the situation:

All devices log to syslog-ng
Syslog-ng then forwards logs to individual NMS systems, like Ciscoworks,
etc.

We're setting up a demo of Loglogic and are forwarding from the NG
server to Loglogic.
I'm getting the messages on the Loglogic side, but the originating
hostnames are coming in as the NG server, not the actual device names
(so it only sees one source)

I've tried setting keep_hostname(no); but this doesn't seem to correct
the problem.
Any suggestions?

TIA!
Clayton

[Attachment #3 (text/html)]

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7651.14">
<TITLE>Problem with hostnames (keep_hostname(no);)</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->

<P><FONT SIZE=2 FACE="Arial">Hiya folks,</FONT>

<BR><FONT SIZE=2 FACE="Arial">Here's the situation:</FONT>
</P>

<P><FONT SIZE=2 FACE="Arial">All devices log to syslog-ng</FONT>

<BR><FONT SIZE=2 FACE="Arial">Syslog-ng then forwards logs to individual NMS systems, \
like Ciscoworks, etc.</FONT> </P>

<P><FONT SIZE=2 FACE="Arial">We're setting up a demo of Loglogic and are forwarding \
from the NG server to Loglogic.</FONT>

<BR><FONT SIZE=2 FACE="Arial">I'm getting the messages on the Loglogic side, but the \
originating hostnames are coming in as the NG server, not the actual device names (so \
it only sees one source)</FONT></P>

<P><FONT SIZE=2 FACE="Arial">I've tried setting keep_hostname(no); but this doesn't \
seem to correct the problem.</FONT>

<BR><FONT SIZE=2 FACE="Arial">Any suggestions?</FONT>
</P>

<P><FONT SIZE=2 FACE="Arial">TIA!</FONT>

<BR><FONT SIZE=2 FACE="Arial">Clayton</FONT>
</P>

</BODY>
</HTML>

_______________________________________________
syslog-ng maillist  -  syslog-ng@lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

--===============1414474354==--

[prev in list] [next in list] [prev in thread] [next in thread] 