I'm using the home user licence and have found what appears to problem with the Remote Syslog Server module.
I have my UTM sending all log files to my local splunk installation.
Problem.
When my internet provider changes my gateway ip address, (or I do a reconnect and get assigned a new ip) the hostname in my log files changes.
Solution.
Log into the UTM, go to Log Settings -> Remote Syslog Server, and then Disable and re-Enable. The log files are now showing the correct hostname.
(Why isn't there an option to attach an example log file.. to this..)
Example log file below..
This shows when the connection gateway was reset.
2016-05-11T11:07:35.338554+10:00 astaro.tspoon.com.au 2016: 05:11-11:07:05 awed [master][4209]: Cannot connect: Connection refused
2016-05-11T11:07:35.418430+10:00 astaro.tspoon.com.au 2016: 05:11-11:07:05 astaro irqd[5333]: received SIGTERM
2016-05-11T11:10:09.416435+10:00 gateway 2016: 05:11-11:08:58 astaro syslog-ng[4458]: syslog-ng starting up; version='3.4.7'
2016-05-11T11:10:09.416435+10:00 gateway 2016: 05:11-11:08:59 astaro ulogd[4449]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth2" srcmac="00:08:a2:09:31:20" srcip="192.168.11.1" dstip="192.168.11.2" proto="6" length="60" tos="0x00" prec="0x00" ttl="64" srcport="58795" dstport="515" tcpflags="SYN"
This shows when I disabled, then re-enable the remote syslog
2016-05-11T16:24:24.774352+10:00 gateway 2016: 05:11-16:23:54 astaro middleware[3706]: T core::Config::Changed:194() => configversion=13
2016-05-11T16:24:24.777239+10:00 gateway 2016: 05:11-16:23:54 astaro middleware[3706]: T core::Config::Changed:204() => nodes=1 objects=0 triggers=0
2016-05-11T16:24:24.777934+10:00 gateway 2016: 05:11-16:23:54 astaro middleware[3706]: T core::Config::load:347() => modules=1,2
2016-05-11T16:24:34.190335+10:00 astaro.tspoon.com.au 2016: 05:11-16:24:02 astaro syslog-ng[4458]: Configuration reload request received, reloading configuration;
2016-05-11T16:24:34.190335+10:00 astaro.tspoon.com.au 2016: 05:11-16:24:03 astaro middleware[3706]: T modules::ipset::deleteUnused:320() => auto#=9/682 confd#=1/341
Trevor..
This thread was automatically locked due to age.