Hostname in Syslog Header Becomes Hyphen when Syslog HOSTNAME Format" is Set to "none""
Resolution
Overview
In PAN-OS 6.0.0, the following enhancement was added:
Enhancement in the Syslog Header –the user can now choose the format of the hostname field in the syslog header. The syslog header can display one of the following:
- FQDN (hostname and domain name)
- Hostname
- IPv4 address
- IPv6 address of the sending device
This option can be configured in the Send Hostname in Syslog drop-down field on the Device (or Panorama) > Setup > Management > Logging and Reporting Settings section. The drop-down field provides the following choices:
- FQDN
- Hostname
- IPv4 address
- IPv6 address
- None (select None to leave the hostname field in the syslog header empty)
Details
In PAN-OS 6.0 and above, the hostname in syslog header becomes hyphen as follows when "Syslog HOSTNAME Format" is set to "none".
---------------------------------------
May 8 12:13:17 - 1,2014/05/08
---------------------------------------
In PAN-OS 5.0 and 5.1, the hostname in syslog header becomes empty as follows when "Send Hostname in Syslog" is disabled.
---------------------------------------
May 8 12:06:01 1,2014/05/08
---------------------------------------
Syslogs with hostname set to "-" or empty strings are equivalent. In almost all cases, syslog servers prefer getting the "-" for empty values. This is working as expected.
owner: ymiyashit