Hi, this info is read from the header (RFC3164 or 5424 depending on format).
You may be more interested in fromhost-ip property (but that's the last hop in a relay scenario). HTH Rainer El mié., 11 nov. 2020 a las 16:38, Psquare via rsyslog (<[email protected]>) escribió: > > Hi Everyone, > > I have few queries regarding rsyslog functioning. I am using rsyslog > service to collect the logs. For separating the logs coming from different > sources, I am creating the files as per the source IP address, and using > the 'hostname' property for the same. In some cases the "hostname" > property is getting resolved to the 'IP address', but in other cases it > shows as "local host". > However, 'fromHost' value is getting resolved to the IP address. > > Would you please enlighten me why it is happening? How does the 'rsyslog' > determine its value, is it by reading the header or payload of the > message?. Kindly also help me to understand the exact and > detailed difference of below 4 properties and which one should be used > where? > > *hostname* > *source* > *fromhost* > *fromhost-ip* > > I really appreciate your help! > > Thanks, > Prashant > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
