Two different host names for the same host

[hartfoml]

I have a Linux client with a UF reporting two different formats of host name.

1) host.name.local.net
2) host.name

I looked in all input and output.conf and the server.conf and could only find the host=host.name.local.net

I noticed that in only two types of events are the hostname different.
source=/var/log/messages
source=/var/log/cron

two commands (ifconfig and sadc) are recorded in the messages log and both are failing to collect information due to permissions. these two are not the only two logs in the messages but are by far the dominant record.

The other job or item with the wrong host name is crond[21282]: (root) CMD (/usr/lib64/sa/sa1 1 1)

I don't know why these jobs are failing or why the host name is wrong.

Any sugestions?

[kristian_kolb]

you're welcome.

[hartfoml]

this seems to be the right answer. will you put it in as an answer so I can give you credit. Also if you have any suggestions on how (if you wanted to) would you fixing this issue.

Thanks for the speedy help!!!

[kristian_kolb · Accepted solution]

This can be related to the fact that data with the syslog sourcetype will be parsed in a special way, where the host value is extracted from each individual message, i.e. there is an index-time transform that overwrites the value from inputs.conf.

---

UPDATE:

As for 'fixing' it, you could either
a) set another sourcetype for these inputs
b) create a new TRANSFORM that will remove the .local from the host, and call that from props.conf.

There are probably other good ways to deal with this, but it will depend on whether this a common or isolated problem

/K

[hartfoml]

Thanks for the suggestions