# F5 Sending syslogs with two hostname to remote syslog server

**URL:** <https://community.f5.com/t/f5-sending-syslogs-with-two-hostname-to-remote-syslog-server/48423>\
**Category:** Technical Forums\
**Tags:** afm, big-ip, log, splunk, syslog, security, ltm, application-delivery\
**Created:** [November 13, 2020, 5:29pm UTC](https://community.f5.com/t/f5-sending-syslogs-with-two-hostname-to-remote-syslog-server/48423 "2020-11-13T17:29:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![IRONMAN](https://avatars.discourse-cdn.com/v4/letter/i/f9ae1b/32.png) [@IRONMAN](https://community.f5.com/u/IRONMAN)\
**Post date:** [November 13, 2020, 5:29pm UTC](https://community.f5.com/t/f5-sending-syslogs-with-two-hostname-to-remote-syslog-server/48423/1 "2020-11-13T17:29:05Z")

</div>

HI All,

we have F5 Device (LTM + AFM), we configured syslog sever splunk via linux syslog server as forwarder.

in Linux server each F5 creating two syslog files, only with just host name and another one is FQDN name.

Both are different logs , not duplicate .

I am not sure, where to merge it or make it single, any one guide me please!

---

<div class="post-metadata">

**Author:** ![jaikumar\_f5](https://avatars.discourse-cdn.com/v4/letter/j/6a8cbe/32.png) [@jaikumar\_f5](https://community.f5.com/u/jaikumar_f5)\
**Post date:** [November 16, 2020, 8:45am UTC](https://community.f5.com/t/f5-sending-syslogs-with-two-hostname-to-remote-syslog-server/48423/2 "2020-11-16T08:45:39Z")

</div>

From what I can think of, its coming from 2 different source ip’s.

One could be your management ip and other your self IP address.

When the traffic comes to the forwarders, it does reverse lookup for the IP and creates the log file respectively.

But I dont see a problem on this, its quite common. All you have to do is, work with your splunk team, to index them properly. As long as both the logs source type are same, and indexed to one common indexer, its not a big deal.

Else you’ll have to make changes on the LTM to force the logs to go out through one interface, either mgmt or tmm. There’s KB articles to that.

Hope this helps.

---

<div class="post-metadata">

**Author:** ![IRONMAN](https://avatars.discourse-cdn.com/v4/letter/i/f9ae1b/32.png) [@IRONMAN](https://community.f5.com/u/IRONMAN)\
**Post date:** [May 7, 2021, 4:43am UTC](https://community.f5.com/t/f5-sending-syslogs-with-two-hostname-to-remote-syslog-server/48423/3 "2021-05-07T04:43:28Z")

</div>

HI ,

We have solution for this.

> **[myF5](https://my.f5.com/manage/s/article/K76259573)**

**Recommended Actions**

Include “options {use\_fqdn(yes); keep\_hostname(no); };” to syslog configuration :

Use following command in CLI:

tmsh modify sys syslog include “options {use\_fqdn(yes); keep\_hostname(no); };”

F5 has option to mark his host name in (only host name or FQDN name) in syslog message.