title: %HOSTNAME% value is "unknown" in rsyslog
body: <blockquote>
    <p><em>The Gist</em></p>
    
    <p>Where does rsyslog get the value of %HOSTNAME%?<br>
    Why does an application served by Tomcat have the correct %HOSTNAME%, but a console application with the same configuration has "unknown" as the hostname?</p>
  </blockquote>
  
  <p>We're using rsyslog on an EC2 instance and we're trying to send our logs out to loggly.  If I <code>tail -f</code> the log messages, I can see the log in the default format including date, hostname, tag, and message.</p>
  
  <p>If I use <code>logger "message"</code> then I see a correct log entry both in the console and in loggly.  However, if a java console application logs an event, the hostname is "unknown" both in the console and in loggly.</p>
  
  <p>Oddly, the same configuration of rsyslog, syslog4j, and log4j results in the correct log entry if it comes from a web application hosted by tomcat.</p>
  
  <p>Where does rsyslog get the value of %HOSTNAME%?  Why does an application served by Tomcat have the correct %HOSTNAME%, but a console application with the same configuration has "unknown" as the hostname?</p>