Return
-
Title
Why does syslog-NG SSB appear to send log messages related to the appliance itself with different hostnames? -
Description
When viewing the logs from syslog-ng SSB, it is noted that we can see that messages related to the SSB appliance are delivered with different names. -
Cause
There can be up to three different hostnames in the logs in order to see which log is coming from which instance of syslog-ng. -
Resolution
There are 3 syslog-ng instances running on a single SSB:-boot-shell local system logging - hostname: set in Basic settings -> Network + Node ID-core-shell local system logging - hostname: set in Basic settings -> Network-core-shell main syslog-ng which provides the functionality of the SSB - hostname (master): ssb1In case of HA the slave node is logging with ssb1 or ssb2 hostname based on which node is the slave.These three have different hostnames in the logs in order to see which log is coming from which instance. The first two are the local source; the third one is the internal built-in source.If you do not wish to see the node ID, you can disable the setting via the GUI:Basic settings | Syslog: Include node ID in hostname in boot firmware messagesIf you disable this, there will be no ID after the hostname in case of the local logs; but there will be still 2 hostnames in standalone and 3 hostnames in HA mode.