# Centralized SysLog Firewall

**URL:** <https://community.graylog.org/t/centralized-syslog-firewall/34064>\
**Category:** Graylog Central (peer support)\
**Created:** [November 5, 2024, 11:01am UTC](https://community.graylog.org/t/centralized-syslog-firewall/34064 "2024-11-05T11:01:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dexter23](https://avatars.discourse-cdn.com/v4/letter/d/e480ec/32.png) [@Dexter23](https://community.graylog.org/u/Dexter23)\
**Post date:** [November 5, 2024, 11:01am UTC](https://community.graylog.org/t/centralized-syslog-firewall/34064/1 "2024-11-05T11:01:10Z")

</div>

Hi everyone, i’m new to graylog, just yesterday i deploy it using the docker-compose file in the official docs.

My question is:

- How can i collect log for multiple in this case openwrt firewall on the same input and separate them by tag or something for each one?

What is the best practies in this scenario?  
Thanks 🙂

---

<div class="post-metadata">

**Author:** ![drewmiranda-gl](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/drewmiranda-gl/32/13376_2.png) [@drewmiranda-gl](https://community.graylog.org/u/drewmiranda-gl)\
**Post date:** [November 5, 2024, 4:50pm UTC](https://community.graylog.org/t/centralized-syslog-firewall/34064/2 "2024-11-05T16:50:37Z")

</div>

All messages that are sent to graylog require a hostname in some way. For example, the syslog RFCs require a hostname as part of a valid syslog message. When using GELF, a hostname is required as well.

This allows graylog to sort the messages by original source/hostname. Let me know if this does not make sense or you have further questions.

---

<div class="post-metadata">

**Author:** ![Dexter23](https://avatars.discourse-cdn.com/v4/letter/d/e480ec/32.png) [@Dexter23](https://community.graylog.org/u/Dexter23)\
**Post date:** [November 6, 2024, 7:10am UTC](https://community.graylog.org/t/centralized-syslog-firewall/34064/3 "2024-11-06T07:10:03Z")

</div>

Hi and thx for answering  
Yes i understand more or less, i configure 1 openwrt device and i receive the log, but as i said in the 1st post i have 20-30 device i want to receive syslog and most of the has the same hostname for example “fw01” or “srv01” so is there a way to customize for example for receive the log with “customername-fw01” ?  
This is a screenshoot of a receive log message:

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/4/4/44b18fe436b3f1e913a6f111d07ecd0489094852.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 20, 2024, 7:10am UTC](https://community.graylog.org/t/centralized-syslog-firewall/34064/4 "2024-11-20T07:10:42Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.