From edwin@nwm.wan.philips.com  Wed Jun 24 12:17:38 1998
Received: from gw-nl1.philips.com (gw-nl1.philips.com [192.68.44.33])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id MAA09363
          for <FreeBSD-gnats-submit@freebsd.org>; Wed, 24 Jun 1998 12:17:31 -0700 (PDT)
          (envelope-from edwin@nwm.wan.philips.com)
Received: from smtprelay-nl1.philips.com (localhost.philips.com [127.0.0.1])
          by gw-nl1.philips.com with ESMTP id VAA08067
          for <FreeBSD-gnats-submit@freebsd.org>; Wed, 24 Jun 1998 21:17:22 +0200 (MEST)
          (envelope-from edwin@nwm.wan.philips.com)
Received: from nwm.wan.philips.com (rs.nwm.wan.philips.com [161.89.1.133]) 
	by smtprelay-nl1.philips.com (8.8.5/8.6.10-1.2.2m-970826) with ESMTP id VAA05124
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 24 Jun 1998 21:17:22 +0200 (MET DST)
Received: (from edwin@localhost)
	by nwm.wan.philips.com (8.8.6/8.8.6) id TAA35084
	for FreeBSD-gnats-submit@freebsd.org; Wed, 24 Jun 1998 19:17:21 GMT
Received: from smtprelay-nl1.philips.com (smtprelay-eur1.philips.com [130.139.36.3])
	by nwm.wan.philips.com (8.8.6/8.8.6) with ESMTP id JAA32216
	for <edwin@nwm.wan.philips.com>; Wed, 24 Jun 1998 09:21:39 GMT
Received: from rs.nwm.wan.philips.com (rs.nwm.wan.philips.com [161.89.1.226]) 
	by smtprelay-nl1.philips.com (8.8.5/8.6.10-1.2.2m-970826) with ESMTP id LAA25844; Wed, 24 Jun 1998 11:21:35 +0200 (MET DST)
Received: (from root@localhost)
	by rs.nwm.wan.philips.com (8.8.7/8.8.7) id LAA05723;
	Wed, 24 Jun 1998 11:22:13 +0200 (CEST)
	(envelope-from mud@nwm.wan.philips.com)
Message-Id: <199806240922.LAA05723@rs.nwm.wan.philips.com>
Date: Wed, 24 Jun 1998 11:22:13 +0200 (CEST)
From: edwin@nwm.wan.philips.com
Sender: edwin@nwm.wan.philips.com
Reply-To: edwin@nwm.wan.philips.com
To: FreeBSD-gnats-submit@freebsd.org
Cc: edwin@nwm.wan.philips.com
Subject: multiple syslog-forwarding will forget the original host
X-Send-Pr-Version: 3.2

>Number:         7055
>Category:       bin
>Synopsis:       [mfc] multiple syslog-forwarding will forget the original host
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    steve
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jun 24 12:20:01 PDT 1998
>Closed-Date:    Mon Sep 7 13:53:29 PDT 1998
>Last-Modified:  Mon Sep  7 13:54:19 PDT 1998
>Originator:     Edwin Groothuis
>Release:        FreeBSD 2.2.5-RELEASE i386
>Organization:
Origin-IT/Systems
>Environment:

	We are having several remote systems which are receiving
	syslog messages from routers, switches etc and we forward
	these messages to a central system for alerting and so.

>Description:

	If these messages are forwarded, the original name of
	the router which has sent the syslog message is lost.

>How-To-Repeat:

	We had the syslog forwarding defined as:
	    router -> remote-system -> central-system

	on the router we have:
	    logging <ip address of remote-system>

	on the remote-system we have in the syslog.conf:
	    local7.*	@central-system

	on the central-system we have:
	    local7.*	/var/log/nmslog

	If the router sends a syslog-message towards the remote-system
	it will be like:
	    date/time d-nl07sc0.wan.philips.com: :SNMP-5:Link Up Trap...

	On the central-system it will become:
	    date/time remote-system: :SNMP-5:Link Up Trap...

>Fix:
	The change has to be made in /usr/src/usr.sbin/syslogd/syslogd.c
	function fprintlog() switch statement F_FORW:

	    Old code line 758:
                l = snprintf(line, sizeof line - 1, "<%d>%.15s %s",  
                             f->f_prevpri, iov[0].iov_base, iov[4].iov_base);    
	    New code:
		/* check for local vs remote messages */
		if (strcmp(f->f_prevhost,LocalHostName))
		    l = snprintf(line, sizeof line - 1,
			    "<%d>%.15s Forwarded from %s: %s",
			    f->f_prevpri, iov[0].iov_base, f->f_prevhost,
			    iov[4].iov_base);
		else
		    l = snprintf(line, sizeof line - 1, "<%d>%.15s %s",
			    f->f_prevpri, iov[0].iov_base, iov[4].iov_base);


>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->suspended 
State-Changed-By: phk 
State-Changed-When: Thu Jun 25 00:01:54 PDT 1998 
State-Changed-Why:  
awaiting committer 
Responsible-Changed-From-To: freebsd-bugs->steve 
Responsible-Changed-By: steve 
Responsible-Changed-When: Sat Jun 27 14:42:09 PDT 1998 
Responsible-Changed-Why:  
I will merge after a short trial period in -current. 
State-Changed-From-To: suspended->closed 
State-Changed-By: steve 
State-Changed-When: Mon Sep 7 13:53:29 PDT 1998 
State-Changed-Why:  
Jordan already merged this fix in revision 1.12.2.13 of syslogd.c. 
Thanks Martin for reminding me. 
>Unformatted:
