FQDNs during migration from syslogd to syslog-ng
Self-answer. It seems to be impossible to imitate syslogd behavior. After a lot of experiments, I provide updated snapshot of my research/guesses on syslog-ng options:
options {
#####################################################################
### the flow of decisions for hostnames, syslog-ng 1.6.8:
use_dns(yes); # yes = first resolve the IP in $HOST_FROM (the message sender)
keep_hostname(no); # no = ignore $HOST embedded in the message (rare); overwrite $HOST with $HOST_FROM
# note: RFC3164 allows embedding short hostname or IP, not FQDN
use_fqdn(yes); # yes = expand everything to FQDN, including local name
# Note syslogd behaviour is incompatible: use FQDN, but strip local
# domain + strip "-s" domains + strip domains for "-l" hosts
chain_hostnames(no); # no = keep $FULLHOST same as $HOST;
# do not expand $FULLHOST into either "src@$HOST" for localhost,
# or to "$HOST/$HOST_FROM" for remote client
#long_hostnames(no); # synonym of chain_hostnames
### with default template, the resulting $FULLHOST is written to log
#####################################################################
check_hostname(yes); # invalid chars?
sync(0); # sync immediately
};
I've found out that messages from my remote systems probably do not have hostname embedded, and this causes keep_hostname to be of no use.