Getting Data In

Forward syslog maintain the source IP

gballanti
Explorer

Hi All,

i'm struggling with the syslog configuration to forward events and maintain the original source IP.

By rsyslog daemon i collect the data in a file then i need to forward  after parsing to a third syslog receiver. On my HF i have the following configuration:

inputs.conf

[monitor:///opt/syslog/udp_514/udp_switch.log]
disabled = 0
sourcetype = syslog

 

outputs.conf

[syslog:forward_syslog]
server = 172.18.0.32:514

 

props.conf

[source::/opt/syslog/udp_514/udp_switch.log]
TRANSFORMS-t1 = to_syslog,to_null

 

transforms.conf

[to_syslog]
REGEX = <regex filter>
DEST_KEY = _SYSLOG_ROUTING
FORMAT = forward_syslog

[to_null]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = nullQueue

 

this configuration is working fine, unfortunately the source ip is changed

log in udp_switch.log "Sep 8 11:30:52 10.10.10.5 TEST5,007251000106157"

in third party syslog the ip changes from "10.10.10.5" with the Heavy forwarder one.

Is it possible to maintain the original IP, and how ?

Many thanks

 

 

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Short answer is "no".

Long answer is that if splunks sends data to a third party it is the initiator of the connection (or the source of UDP packets in case of UDP syslog). So the metadata extracted on the destination server from the connection parameters will point back at splunk server. The only possibility to pretend that the packets came from the original source (possible only with UDP) would be to spoof the original source - that's possible with rsyslog using a proper output module, maybe with syslog-ng but definitely not with splunk.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Short answer is "no".

Long answer is that if splunks sends data to a third party it is the initiator of the connection (or the source of UDP packets in case of UDP syslog). So the metadata extracted on the destination server from the connection parameters will point back at splunk server. The only possibility to pretend that the packets came from the original source (possible only with UDP) would be to spoof the original source - that's possible with rsyslog using a proper output module, maybe with syslog-ng but definitely not with splunk.

0 Karma

gballanti
Explorer

thanks Rick,

i was suspecting that, but how we say "Hope is last to die".

Regards

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...