Mar 24 2021 10:19 AM - edited Mar 24 2021 10:45 AM
I am sending AIX logs to a central rsyslog server and using the Syslog Connector to pull the logs into Azure Sentinel. The ComputerName field is populating as `Message` and not the actual hostname or IP of the system. Anyone have thoughts on how to fix this?
Mar 24 2021 11:46 AM - edited Mar 24 2021 11:52 AM
Long story short, AIX adds a "Message forwarded by $hostname" string. You have to start syslogd on AIX with the flags:
startsrc -a -n -s syslogd
Nov 21 2022 12:51 AM