Hi All,
i'm struggling with the syslog configuration to forward events and maintain the original source IP.
By rsyslog daemon i collect the data in a file then i need to forward after parsing to a third syslog receiver. On my HF i have the following configuration:
inputs.conf
[monitor:///opt/syslog/udp_514/udp_switch.log] disabled = 0 sourcetype = syslog |
outputs.conf
[syslog:forward_syslog] server = 172.18.0.32:514 |
props.conf
[source::/opt/syslog/udp_514/udp_switch.log] TRANSFORMS-t1 = to_syslog,to_null |
transforms.conf
[to_syslog] [to_null] |
this configuration is working fine, unfortunately the source ip is changed
log in udp_switch.log "Sep 8 11:30:52 10.10.10.5 TEST5,007251000106157"
in third party syslog the ip changes from "10.10.10.5" with the Heavy forwarder one.
Is it possible to maintain the original IP, and how ?
Many thanks
Short answer is "no".
Long answer is that if splunks sends data to a third party it is the initiator of the connection (or the source of UDP packets in case of UDP syslog). So the metadata extracted on the destination server from the connection parameters will point back at splunk server. The only possibility to pretend that the packets came from the original source (possible only with UDP) would be to spoof the original source - that's possible with rsyslog using a proper output module, maybe with syslog-ng but definitely not with splunk.
Short answer is "no".
Long answer is that if splunks sends data to a third party it is the initiator of the connection (or the source of UDP packets in case of UDP syslog). So the metadata extracted on the destination server from the connection parameters will point back at splunk server. The only possibility to pretend that the packets came from the original source (possible only with UDP) would be to spoof the original source - that's possible with rsyslog using a proper output module, maybe with syslog-ng but definitely not with splunk.
thanks Rick,
i was suspecting that, but how we say "Hope is last to die".
Regards