topic Re: Forward syslog maintain the source IP in Getting Data In

Forward syslog maintain the source IP

gballanti — Wed, 08 Sep 2021 09:52:10 GMT

Hi All,

i'm struggling with the syslog configuration to forward events and maintain the original source IP.

By rsyslog daemon i collect the data in a file then i need to forward after parsing to a third syslog receiver. On my HF i have the following configuration:

inputs.conf

[monitor:///opt/syslog/udp_514/udp_switch.log]
disabled = 0
sourcetype = syslog

outputs.conf

[syslog:forward_syslog]
server = 172.18.0.32:514

props.conf

[source::/opt/syslog/udp_514/udp_switch.log]
TRANSFORMS-t1 = to_syslog,to_null

transforms.conf

[to_syslog]
REGEX = <regex filter>
DEST_KEY = _SYSLOG_ROUTING
FORMAT = forward_syslog

[to_null]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = nullQueue

this configuration is working fine, unfortunately the source ip is changed

in third party syslog the ip changes from "10.10.10.5" with the Heavy forwarder one.

Is it possible to maintain the original IP, and how ?

Many thanks

Re: Forward syslog maintain the source IP

PickleRick — Wed, 08 Sep 2021 10:18:43 GMT

Short answer is "no".

Long answer is that if splunks sends data to a third party it is the initiator of the connection (or the source of UDP packets in case of UDP syslog). So the metadata extracted on the destination server from the connection parameters will point back at splunk server. The only possibility to pretend that the packets came from the original source (possible only with UDP) would be to spoof the original source - that's possible with rsyslog using a proper output module, maybe with syslog-ng but definitely not with splunk.

Re: Forward syslog maintain the source IP

gballanti — Wed, 08 Sep 2021 13:03:03 GMT

thanks Rick,

i was suspecting that, but how we say "Hope is last to die".

Regards