Forward syslog maintain the source IP

[gballanti]

Hi All,

i'm struggling with the syslog configuration to forward events and maintain the original source IP.

By rsyslog daemon i collect the data in a file then i need to forward  after parsing to a third syslog receiver. On my HF i have the following configuration:

inputs.conf

[monitor:///opt/syslog/udp_514/udp_switch.log]
disabled = 0
sourcetype = syslog

outputs.conf

[syslog:forward_syslog]
server = 172.18.0.32:514

props.conf

[source::/opt/syslog/udp_514/udp_switch.log]
TRANSFORMS-t1 = to_syslog,to_null

transforms.conf

[to_syslog]
REGEX = <regex filter>
DEST_KEY = _SYSLOG_ROUTING
FORMAT = forward_syslog

[to_null]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = nullQueue

this configuration is working fine, unfortunately the source ip is changed

log in udp_switch.log "Sep 8 11:30:52 10.10.10.5 TEST5,007251000106157"

in third party syslog the ip changes from "10.10.10.5" with the Heavy forwarder one.

Is it possible to maintain the original IP, and how ?

Many thanks

[PickleRick · Accepted solution]

Short answer is "no".

Long answer is that if splunks sends data to a third party it is the initiator of the connection (or the source of UDP packets in case of UDP syslog). So the metadata extracted on the destination server from the connection parameters will point back at splunk server. The only possibility to pretend that the packets came from the original source (possible only with UDP) would be to spoof the original source - that's possible with rsyslog using a proper output module, maybe with syslog-ng but definitely not with splunk.

[gballanti]

thanks Rick,

i was suspecting that, but how we say "Hope is last to die".

Regards