How do show the host name in sent logs instead of the IP?
We have all of our windows servers running Lasso, and sending the logs via UDP to a linux box running syslog-ng. Very basic setup. The issue that I am having is that the ip address of the windows host shows up in the log instead of the hostname. I have have looked in the documentation and I have not found any way to change this.
So is there any way of showing the hostname instead of IP?
Thanks!
mothbitten,
That may be a syslog-ng configuration issue. Can you paste a couple of lines here so we can see what you mean?
thanks
I would not think it is a syslog issue due to snare (which we use on XP since lasso has issues there) showing the hostname in the logs, as do the linux and solaris hosts, but here are two lines from the logs:
Oct 2 05:59:56 192.168.12.166 MSWinEventLog 0 Security 423693 Thu Oct 02 05:59:53 2008 540 Security WATCH-DOG$ UserSuccess Audit RED-RWS Logon/Logoff Successful Network Logon: User Name: WATCH-DOG$ Domain: ANSS Logon ID: (0x0,0x13D7A199) Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name: Logon GUID: {8004428c-5199-641d-8212-886e6ddd4a7f} Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: - Source Port: - 2443550
Oct 2 05:59:56 192.168.12.166 MSWinEventLog 0 Security 423694 Thu Oct 02 05:59:53 2008 538 Security WATCH-DOG$ UserSuccess Audit RED-RWS Logon/Logoff User Logoff: User Name: WATCH-DOG$ Domain: ANSS Logon ID: (0x0,0x13D7A199) Logon Type: 3 2443551
Thanks!