Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can syslog-ng be configured to send both the hostname and the IP address. Currently, logs are sent with the IP address of the device/machine, but we want to add the hostname so I could keep my ip management database up to date with the correct hostname (no, I don't use DHCP :))

share|improve this question
up vote 2 down vote accepted

If you are sending from one syslog-ng server to another, just add the keep_hostname(yes) option.

If you are sending from syslog-ng to some other syslog daemon, you need to compile from source and use the enable source spoof option.

If you just want names instead of IPs, then try use_dns(yes).

Here's a short video on configuring syslog-ng.

share|improve this answer
Note that use_dns(yes) requires reverse DNS lookups from the central syslog-ng server on the source server's IP address to work. – Ladadadada May 11 '12 at 5:19
To add to what Ladadadadada (or something, heh) said, if you have use_dns and no dns available, it will use your /etc/hosts first - assuming you have files, dns set in your nsswitch.conf. – Clayton Dukes May 11 '12 at 13:46
options 1 and 2 is the way to go... thanks! – Ed Gl May 12 '12 at 13:48

I like using the following due to the amount of hosts we maintain.

rewrite r_host { set("", value("HOST")); };
log { source(s_src); destination(d_mysyslog); rewrite(r_host); };
destination d_mysyslog { tcp("" port(1514) tls(ca_dir("/etc/syslog-ng/cert.d"))); };

And these settings on the syslog-ng server:

long_hostnames(on); use_dns(no); use_fqdn(no);

This rewrites the hostname vs having to maintain any hosts lists on the syslog server. And presents this on the syslog-ng server:

Sep 27 13:20:01 CRON[11729]: pam_unix(cron:session): session closed for user root
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.