Date parsed: 2/15/2002 5:05:54 PM
Date: Fri, 15 Feb 2002 17:05:54 +0100
the source ip-address is the ip-address of the sender of the syslog
datagram, which is, of course, the ip-address of the forwarding SL4NT
But you can do the following on the first (forwarding) SL4NT computer:
Create a custom log format with (for example) the following format string:
Then configure your forwarding action to use this new custom log format.
By doing this, the ip-address of the originating device will be included in
the message text that is forwarded to the second SL4NT computer.
"simmi" <firstname.lastname@example.org> wrote in message
> I'm using SL4NT on one NT server to receive syslog messages from multiple
> systems. This server in turn passes them on to another server running
> which logs them to one file. However, all the entries have the IP address
> of the first NT server so I can't tell from which source system each
> came. What can I change to enable the original IP address to appear in
> consolidated log?