Yes, this is normal. LI licenses based on the hostname field (the originator of the message) not the source field (the last hop before reaching the LI server). The reason for this is because the source may be a syslog aggregator, an external LB or even a NAT. Per the syslog RFC, the hostname field is the originator of the message. In the case of View, unfortunately, the logs put the VM in the hostname field even though they did not originate the message. A potential solution to this problem is to have the VM be the source and the View component be the hostname, but at the end of the day this is a View logging bug. I would suggest opening this on the View forum, but I will will escalate this on my end as well.