I have a question about hostname field that
journalctl displays. From
journalctl documentation I know that
_hostname= is displaying the name of the originating host. So in that case this log:
march 10 01:07:00 test su: pam_unix(su-l:session): session opened for user root by (uid=1000)
means that the event took place in the installed, local system test. But what if there are more hosts?
Considering the server, in one computer an event can take place and the other one will register it. In this case, in the computer that collects logs, the hostname should indicate the name of the originating host.
Is there any way of proving that the hostname actually points to the system where the event took place? Can this be proven in one local system, where the event took place and was registered (by this system) at the same time?