We've got more than a dozen Heavy Forwarders (HF) that are behind a pair of load balancers that handle all our system log (syslog) traffic. Is there any way to trace back or tag the events to know which specific HF they were passed through?
Thanks for the suggestion. We're currently bumping our license limit so thank you for the warning about that particular complication.
I'll also have to ponder this a bit because I want to keep the existing host/source information I just want to add the heavy forwarder as a troubleshooting/monitoring function. Not to mention the complications of managing separate props/transforms on each heavy forwarder.. I hadn't previously considered that added complexity. But you've given me a good place to start. Thank you!