Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have DMZ hosts forwarding to a DMZ syslog which in turn forwards all the syslog messages to an internal syslog server. It's working fine for the most part but the internal syslog host messages appear to all be coming from the DMZ syslog ie it loses the original hostnames.

{Hosts} -> {DMZ syslog: openbsd: syslog v 1.17} -> {Internal Syslog: rsyslog v3}

How can I preserve the hostnames?


share|improve this question
up vote 3 down vote accepted

Personally I would recommend using syslog-ng for your internal server - it provides a whole lot more than rsyslog. Of specific interest in your case it provides some much better handling for managing / rewriting / etc for the hostnames.

If you decide to stick with rsyslog this configuration does preserve both the remote and local hostnames - it is what I used before switching to syslog-ng.

$UDPServerRun 514
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 *
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log

I also was using the "-c 4" options in my init script, if it matters.

share|improve this answer

Configure /etc/rsyslog.conf to preserve the FQDN: $PreserveFQDN on

share|improve this answer
Important to mention that the directive should be placed at the beginning of the file, before other directives – yegor256 Nov 16 '12 at 18:03

Piping the syslog message to netcat will add the hostname.

A simple way is to pipe messages using netcat (nc) in the syslog.conf file as follow:

. "TAB" | nc RemoteLogServer -u 514 -w 1"

A TAB character must be inserted before the pipe symbol.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.