The e-mail variable $Message.MsgHost does not display Hostname or IP address in Kiwi Syslog NG 1.4 and below

The E-Mail variable $Message.MsgHost is being translated into a series of numeric values, such as the RFC header.

The “numeric numbers” mentioned are not random values—they are information from RFC headers, which KSS NG processes according to common standards. 

To confirm it (that the numbers in the mail are not random values but the RFC header from the device), you may check Wireshark logs or enable RFC headers columns on the Events page of KSS NG. You will see that this info is a part of the RFC header (hostname).

This issue occurs because Kiwi Syslog NG will process the RFC header that is being sent by the device by default.

To resolve this issue, please upgrade to Kiwi Syslog NG 1.4.1 and above. Message variables were expanded to include RFCHost and IPAdd along with the current MsgHost.  The new logic allows more flexibility to meet customer needs.

1. If no DNS and no RFC header exists, IP address will display all message variables
2. If DNS exists and no RFC header exists:
   • MsgHost - Resolved DNS name
   • RFCHost - IP address
   • IPAdd - IP address
3. If no DNS and RFC header exists:
   • MsgHost - Resolved DNS name
   • RFCHost - Resolved DNS name (from RFC header)
   • IPAdd - IP Address
4. If DNS and RFC header exists:
   • MsgHost - Resolved DNS name
   • RFCHost - Resolved DNS name (from RFC header)
   • IPAdd - IP address

If upgrade is not possible, please use the following one of the workarounds:

1. Customer need to configure correctly RFC headers on the device side (to send the correct RFC header).
2. Customer need to disable RFC headers on the device side at all - in that case, KSS NG will process DNS name or IP.