default-network-drivers() is not getting fortigate logs hostname ($HOST) correctly about syslog-ng

[bazsi]

the default-network-drivers() source uses so called application adapters that help syslog-ng parse non-standard formats.

The one for Fortigate is here: https://github.com/syslog-ng/syslog-ng/blob/master/scl/fortigate/fortigate.conf

As I see, it does not override $HOST at the moment, so it stays the syslog-ng default, e.g. the one resolved from the sending IP address.

This PR has an untested fix for this case: #4884

can you check if it works and report back? thanks

[bazsi]

I quickly tested this and it works nicely.

[bazsi]

@pwnjack indeed the FortiGate documentation does not mention devname, how come your fortigate does have that? is this a specific configuration?

[pwnjack]

@pwnjack indeed the FortiGate documentation does not mention devname, how come your fortigate does have that? is this a specific configuration?

Not entirely sure why, maybe is tied to the Fortinet version, but you can see it mentioned in this manual (page 80).