Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For some reasons, we redirect syslog events from RHEL 6 (with rsyslog) to RHEL 5 (with syslogd).

On RHEL 6 in rsyslog.conf:

*.*                 @

On RHEL 5 in /etc/sysconfig/syslog:


On RHEL 6, the event looks like (/var/log/secure):

Oct 25 02:10:03 rh6q32 sshd[1849]: pam_unix(sshd:session): session closed for user root

On RHEL 5, the same event looks like (/var/log/secure):

Oct 25 02:10:03 rh6q32 rh6q32 sshd[1849]: pam_unix(sshd:session): session closed for user root

The difference is double using of host name (rh6q32).

The question: is it possible to get rid of double hostname?

Thanks, Yuri

share|improve this question
dont you mean from rhel6 to rhel5 ? or your output is swapped. i cant see why you'd have the hostname twice to begin with, then once after redirection. – Sirex Oct 26 '11 at 12:24
Yes, from rhel 6 to rhel 5, thanks. What could be the reason for this behaviour? – user54614 Oct 26 '11 at 15:34
up vote 1 down vote accepted

the difference is that apparently 6 is using rsyslog insteal of the old syslog. You can customize rsyslog with templates:

$template sysklogd,"<%PRI%>%TIMESTAMP% %syslogtag%%msg%"
*.*     @;sysklogd


share|improve this answer
Jure1873, it works, thanks! – user54614 Oct 27 '11 at 12:45

RHEL5 syslog doesn't send a 'correct' header according to RFC3164 (yay standards). There's supposed to be a hostname in the syslog packet. rhel5.x syslogd adds the source host to incoming syslog traffic.

As someone else said, rsyslog was added in RHEL 6.x, which is RFC3164 compliant. Hey presto your syslogd ends up adding a host field that's already there.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.