HOSTNAME field of the Syslog message as defined in RFC 5424 - The
Syslog Protocol.
The HOSTNAME field identifies the machine that originally sent the
syslog message.
The HOSTNAME field SHOULD contain the hostname and the domain name of
the originator in the format specified in STD 13 [RFC1034]. This
format is called a Fully Qualified Domain Name (FQDN) in this
document.
In practice, not all syslog applications are able to provide an FQDN.
As such, other values MAY also be present in HOSTNAME. This document
makes provisions for using other values in such situations. A syslog
application SHOULD provide the most specific available value first.
The order of preference for the contents of the HOSTNAME field is as
follows:
1. FQDN
2. Static IP address
3. hostname
4. Dynamic IP address
5. the NILVALUE
If an IPv4 address is used, it MUST be in the format of the dotted
decimal notation as used in STD 13 [RFC1035]. If an IPv6 address is
used, a valid textual representation as described in [RFC4291],
Section 2.2, MUST be used.
Syslog applications SHOULD consistently use the same value in the
HOSTNAME field for as long as possible.
The NILVALUE SHOULD only be used when the syslog application has no
way to obtain its real hostname. This situation is considered highly
unlikely.