Kiwi SYSLOG NG, when using hostname variable in logfile names, defaults to using the RFC Hostname from the SYSLOG header.
EG: D:\Logs\$Message.HostName-$Message.DateISO.txt
From the support case I raised:-
The KiwiSyslog NG prioritize RFC header to fetch the hostname of the device.
If there is an RFC header, then KSS NG will use the value in here.
If no hostname is configured in the RFC Header, then that is the time the KSS NG will resolve from the DNS name available on the network for the device.
This means some logs are FQDN, some shortname, and some bear no relation to the actual hostname of the device. Example Netscaler logs now have the name, mas_event / mas_config / mas_inventory. vCenter logs now come in as "added". So no continuity using the RFC Hostname.
In the old KSS 9 version, it used the Hostname resolved from DNS, which was a lot easier to ensure was correct and maintain. For alot of appliances, i cannot make any changes to the RFC Hostname in the SYSLOG header
