I think Dogeron was onto the correct answer. Without seeing the config of the intermediate rsyslog server we can't assume it is forwarding the log message with the original source. By default it will not; nor does Kiwi.
Clik here to view.
Image may be NSFW.
Clik here to view.
