Syslog messages with the wrong hostname

[LMH0103]

Hi,

I have recently configured logging on 100+ devices, and all of them are successfully sending their logging messages to a Unix host.

However, 3 of them have an issue where they are sending the incorrect hostname within the message, and I cannot find any reason as to why they are doing this. For example, the router will have the hostname as router1, and the logging will be configured as:

logging origin-id hostname
logging source-interface Loopback0
logging host x.x.x.x
logging host y.y.y.y

However, when you inspect the logs on the collector, they will appear as:

Nov 26 12:53:10 router2.example.local 4554: router1: 004640: *Nov 26 13:22:09.884 UTC: %SYS-5-CONFIG_I: Configured from console by USER1 on vty0 (x.x.x.x)
Nov 26 12:53:19 router2.example.local 4555: router1: 004641: *Nov 26 13:22:18.015 UTC: %SYS-6-PRIVCFG_ENCRYPT_SUCCESS: Successfully encrypted private config file

I cannot understand why the messages are being send with a different hostname, especially when I have configured it using origin-id.I have searched the config, and there is no mention of 'router2', and yet it sends the logging message with this hostname in the message. This is also happening across different versions, as one router is an old 887 running IOS 15.3(3), and it is also happening on another router running IOS XE 17.3.4a.

Can anyone please advise me on how to correct the messages so they have the correct hostname?

Thank you.

[marce1000]

 - I am suspecting that router2.example.local   is a DNS translation by the local syslog server of the IP from the sending host or
defined locally in a hosts file (for instance). 

 M.

[balaji.bandi]

I would check the hostname configuration on the device and also check any DNS A entries that are resolving—remove them and test them.

[DanielP211]

I belive this is a issue of the local domain lookup on the DNS that is configured on the syslog server.

Check the configuration there.

BR

[LMH0103]

I have checked the DNS settings on the collector, and this does not appear to be a DNS issue. It is configured to use an external resolver, so google.com etc. will succeed, whereas router2.example.local will fail.

I have also checked the DNS settings on the router itself, and router2.example.local does not resolve either.

[marce1000]

 - Check the collector's logging configuration , perhaps any translations are being configured in there 

 M.

[balaji.bandi]

from syslog can you ping router1 and router2.example.com and post the output here.

from router can you post show run | in hostname