origin DEFAULT in format files of LFA is sometimes substituted with an unexpected IP addresses depending on name resolution settings.
For example, 'origin' field of events forwarded to EIF probe is filled with an unexpected IP address when DEFAULT is set as 'origin' like the following format file.
This symptom occurs when the machine on which LFA is installed has multiple IP addresses or when duplicate entries exist in /etc/hosts.
%t %s %s*
LFA gets IP addresses via getaddrinfo() when DEFAULT is set in 'origin' field. LFA uses the first IP address when getaddrinfo() returns multiple IP addresses, but it may not be what the user wants to use.
Resolving the problem
1. Make the host unique in /etc/hosts
Modify /etc/hosts for the host to be resolved uniquely.
2. Set CDP_IP_ADDR in the configuration file of LFA
Users can fix the IP address by setting CDP_IP_ADDR parameter in the configuration file of LFA.
UNIX / Linux: