Host information is missing while sending Oracle DB logs on hp-ux to log-server

[S71]

I have several HP-UX servers with Oracle 11G DB on them. Logs of both OS and DB are sending through syslogd to centralized log-server (1.1.1.1), which is running on Oracle Linux. The problem is that received logs from Oracle DB doesn't contain hostname information, however when log is generated on its source (hp-ux server) it has all the information. There are no problem with OS logs.

I've tested same scenario on RHEL virtual machines and there it worked just fine.

logs on source:

Oct 14 16:27:42 hostname Oracle Audit[7745]: LENGTH: "220" ---output info---

logs on log-server:

Oct 14 16:27:42 Oracle Audit[7745]: LENGTH: "220" ---output info---

There are configuration files of both client and server:

HP-UX Server
cat /etc/syslog.conf# @(#)B.11.31_LR#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#mail.debug          /var/adm/syslog/mail.log#database logs
local1.warning      /var/adm/syslog/audit.log
local1.warning      @1.1.1.1
#os logs
*.info;mail.none        /var/adm/syslog/syslog.log
*.info;mail.none        @1.1.1.1
*.emerg         *
*.emerg         @1.1.1.1
*.alert         /dev/console
*.alert                 root
*.alert                 @1.1.1.1

LogServer

# rsyslog v5 configuration file
# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)

$ModLoad imklog   # provides kernel logging support (previously done by rklogd)

#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception

$ModLoad imudp

$UDPServerRun 514

 # Provides TCP syslog reception

$ModLoad imtcp

$InputTCPServerRun 514


$ModLoad ommysql*.* :ommysql:localhost,Syslog,username,password


#### GLOBAL DIRECTIVES ####

# Use default timestamp format

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit

#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/

$IncludeConfig /etc/rsyslog.d/*.conf

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog

# Log cron stuff
cron.*                                                      /var/log/cron

# Everybody gets emergency messages 
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file. 
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                             /var/log/boot.log

# ### begin forwarding rule ###

# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.

#$WorkDirectory /var/lib/rsyslog # where to place spool files
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown    
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# 
### end of the forwarding rule ###

# A template to for higher precision timestamps + severity logging

$template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds% %syslogtag% %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"

:programname, startswith, "spice-vdagent"   /var/log/spice-vdagent.log;SpiceTmpl

$template TmplAuth, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"

$template TmplMsg, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"

authpriv.* ?TmplAuth

*.info,mail.none,authpriv.none,cron.none ?TmplMsg

Can't figure out, how to fix this problem. Need your help :)