-
Title
Syslog-ng Agent for Windows sends the logs with two different hostnames -
Description
Syslog-ng Agent sends the logs with two different hostnames.
-
Cause
Syslog-ng Agent for Windows sends its internal logs, for example MARK messages, with the hostname determined from DNS, while the eventlogs use the hostname of the machine. -
Resolution
Resolution 1 - DNS change
Warning! This solution may affect other systems or applications.
Modify the reverse DNS record of the computer.
The IP address have to be resolved to the machine's hostname.Resolution 2 - Hosts file modification
Warning! This solution may affect other systems or applications.
Add an entry to the C:\Windows\System32\drivers\etc\hosts file, which contains the mappings of IP addresses to host names.
For example, mapping 10.0.0.1 to testhost.10.0.0.1 testhost
Resolution 3 - Setting output message format
Note: This solution can be used only if "Legacy BSD Syslog Protocol" is used for the remote destination.
By default, the following template is used for the outgoing Legacy BSD syslog messages.
${BSDDATE} ${HOST} ${MSGHDR}${MSG}
Set a fix hostname for the outgoing messages by replacing ${HOST}, for example:
${BSDDATE} fixhostname ${MSGHDR}${MSG}