doc: given some concrete advise on the common %hostname% content problem

1 files changed, 8 insertions, 1 deletions

diff --git a/doc/troubleshoot.html b/doc/troubleshoot.html
index cb4367f6..a8855fd4 100644
--- a/doc/troubleshoot.html
+++ b/doc/troubleshoot.html
@@ -18,7 +18,14 @@ is a rsyslog-doc package, that often needs to be installed separately.
 <p><b>Malformed Messages and Message Properties</b>
 <p>A common trouble source are <a href="syslog_parsing.html">ill-formed syslog messages</a>, which
 lead to to all sorts of interesting problems, including malformed hostnames and dates.
-Read the quoted guide to find relief.
+Read the quoted guide to find relief. A common symptom is that the %HOSTNAME% property is
+used for generating dynafile names, but some glibberish shows up. This is caused by the
+malformed syslog messages, so be sure to read the 
+<a href="syslog_parsing.html">guide</a> if you face that problem. Just let me add that the
+common work-around is to use %FROMHOST% or %FROMHOST-IP% instead. These do not take the
+hostname from the message, but rather use the host that sent the message (taken from
+the socket layer). Of course, this does not work over NAT or relay chains, where the
+only cure is to make sure senders emit well-formed messages.
 <p><b>Configuration Problems</b>
 <p>Rsyslog 3.21.1 and above has been enhanced to support extended configuration checking.
 It offers a special command line switch (-N1) that puts it into "config verfication mode".