I have a question about hostname field that journalctl displays. From journalctl documentation I know that _hostname= is displaying the name of the originating host. So in that case this log:

march 10 01:07:00 test su[2396]: pam_unix(su-l:session): session opened for user root by (uid=1000)

means that the event took place in the installed, local system test. But what if there are more hosts?
Considering the server, in one computer an event can take place and the other one will register it. In this case, in the computer that collects logs, the hostname should indicate the name of the originating host.

Is there any way of proving that the hostname actually points to the system where the event took place? Can this be proven in one local system, where the event took place and was registered (by this system) at the same time?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.