I have an indexer that is using two forwarders to get logs. These forwarders are forwarding other forwarders in their zone. One of these forwarders is also setup to forward syslogs from an appliance.
The indexer also receives syslogs from one of these appliances. The problem I have is that the logs coming from the local appliance resolves the name while the logs coming through the forwarder from the remote appliance does not and only sees the host as an IP. Now the forwarder is also forwarding logs from other forwarders, but they resolve their names.
Any idea?
↧