Can a hostname be added to syslog-ng?

Question

How can syslog-ng be configured to send both the hostname and the IP address. Currently, logs are sent with the IP address of the device/machine, but we want to add the hostname so I could keep my ip management database up to date with the correct hostname (no, I don't use DHCP :))

Solution

If you are sending from one syslog-ng server to another, just add the keep_hostname(yes) option.

If you are sending from syslog-ng to some other syslog daemon, you need to compile from source and use the enable source spoof option.

If you just want names instead of IPs, then try use_dns(yes).

Here's a short video on configuring syslog-ng.

Comments

[Ladadadada]

Note that use_dns(yes) requires reverse DNS lookups from the central syslog-ng server on the source server's IP address to work.

[Clayton Dukes]

To add to what Ladadadadada (or something, heh) said, if you have use_dns and no dns available, it will use your /etc/hosts first - assuming you have files, dns set in your nsswitch.conf.

[Ed Gl]

options 1 and 2 is the way to go... thanks!

[deFreitas]

I need to know where put keep_hostname

[deFreitas]

ok here an example /etc/syslog-ng/syslog-ng.conf options {keep_hostname(yes);}; source... it is really hard to find out when you are a newbie

[Clayton Dukes]

That's not a good thing to do if you ever start using a more advanced tool like LogZilla. Instead, put that ip in a metatag with the message, like host_ip="10.72.13.130" $MSG