I want to collect some logs from different applications with different IP addresses and send it from a centralized server to syslog server. Now, question is: How I can send messages from centralized server to syslog server with original IP addresses?


Since you are not specifying any actual tools and configuration, you'll only get general level answer.

Since Syslog is mentioned, I'll assume you are using The Syslog Protocol (RFC 5424). The Syslog Message Format has a HOSTNAME field for the original hostname. If your implementation is based on the protocol, there should be the hostname (or IP, if no FQDN available) of the originating server instead of any intermediate logging server.


The HOSTNAME field identifies the machine that originally sent the syslog message.

In practice, not all syslog applications are able to provide an FQDN. As such, other values MAY also be present in HOSTNAME. This document makes provisions for using other values in such situations. A syslog application SHOULD provide the most specific available value first.
The order of preference for the contents of the HOSTNAME field is as

  1. FQDN

  2. Static IP address

  3. hostname

  4. Dynamic IP address

  5. the NILVALUE

If you are using Windows Event Log API, instead, there's also an element for similar information:

Computer (SystemPropertiesType)

Element The name of the computer on which the event occurred.

<xs:element name="Computer"

So, if you are using the standard tools, your logging system would meet these requirement by default. If you are not using either of these, there's not enough information in your question to tell. Frankly, it would be much easier to use these standardized centralized logging methods, instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.