> when the remote system receives the message, if you have not loaded a
> specific parser module it assumes that what it's receiving is in the
> traditional syslog format.
>
> in your first example, hostname:{%hostname%} triggers something in the
> parsing logic that says that this can't be a legitimate hostname, so it
> puts the IP address of the sender in the hostname field instead.
Jup, colon cannot appear in a hostname, so that field cannot be a hostname
(see relevant RFCs).
Also, the PRI part of the message is missing. For forwarding, you need to
start with
"<%PRI%>..."
(The PRI property may actually have a different name, I did not check this
against the property list).
Rainer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
