syslog-ng-users July 2011 archive
Main Archive Page > Month Archives  > syslog-ng-users archives
syslog-ng-users: Re: [syslog-ng] AIX Syslog Messages

Re: [syslog-ng] AIX Syslog Messages

From: Fekete Robert <frobert_at_nospam>
Date: Wed Jul 06 2011 - 07:04:51 GMT
To: Syslog-ng users' and developers' mailing list <>


did you try setting the keep_hostname(yes) global option?


On 07/05/2011 09:05 PM, Ricardo Oliveira wrote:

> Hi,
> I'm having some problems properly storing messages received from AIX servers.
> The format which they come in is like this:
> "Jul 5 19:30:59 Message forwarded from server2: su: from root to ..."
> According to a thread on this mailing list
> (, and if
> I understood correctly, this should be OK, and I should get the expected
> behaviour of replacing this with the form:
> "Jul 5 19:30:59 server2 su: from root to ..."
> However, what I get in the log is:
> "Jul 5 19:30:59 su: from root to ..."
> Where the is the IP of the machine I got the message from and not
> the name of the server (server2 in this case).
> The issue here is that these messages belong to several machines which are
> sending their syslog messages to a NIM server which in turn forwards them to our
> syslog server, so the IP we end up with is not the machine's IP, but rather the
> NIM server IP, which is not what we need.
> I tried parsing the message on arrival, but it doesn't work, I suppose it's
> because syslog-ng processes it before the parsers kick in.
> Is there a way to do this?
> TIA,
> Ricardo.
> ______________________________________________________________________________
> Member info:
> Documentation:
> FAQ:

Member info: