About splunker52

splunker52 · ‎08-03-2021

Haven't looked at splunkd logs at this point, but will do that as soon as I can. As for inputs.conf, here's a snippet--have tried both ip and dns connection_host options (removed the actual source fqdn and IP for this post) [udp://sourcefqdn:514] index = vmware-esxilog sourcetype = vmw-syslog connection_host = dns disabled = false [udp://sourceipaddress:514] index = vmware-esxilog sourcetype = vmw-syslog connection_host = ip disabled = false

splunker52 · ‎08-03-2021

No, we do not have that configured, but the "Source Address Translation" setting on the VIP is set to "None". Not an F5 expert here, but my understanding is that with this setting set to "None" that the true vmware source IP's would then be visible to the HF's in the VIP pool. This works for other syslog sources coming through the VIP,.

splunker52 · ‎08-03-2021

Hi, We setup an F5 VIP to load balance syslog input to several heavy forwarders on UDP 514. We're successfully receiving syslog events through the F5 VIP from several sources, but for some reason the syslogs from our vmware environment are not being accepted. Network tracing on the F5 VIP shows vmware sources making connections to the front end VIP and the back-end HF's, but the syslogs are not being accepted and processed by the HF's. We've taken one VMWare server and directed syslogs straight to one of the HF's (bypassing the F5), and this works. Any suggestions on what might be happening when sending the vmware syslogs through the F5 that would cause them to not be accepted\received by the HF's? The inputs.conf file has also been configured with all the VMware sources to accept syslog input from. Thank you.

Posts	3
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎08-03-2021

Online Status	Offline
Date Last Visited	‎08-03-2021 06:15 PM

F5 Syslog Load Balancing

Re: F5 Syslog Load Balancing

Re: F5 Syslog Load Balancing

F5 Syslog Load Balancing