Syslog Forwarding Issue

Question

I'm trying to figure out how to Forward an incoming Syslog message from my devices from the Solarwinds Syslog Sever, to a second Syslog server. I'm able to forward the traps along with no problem, but to the secondary system, the message looks like it came from the Solarwinds Syslog server. I need for the Hostname/IP of the originating system to be preserved in the message that gets forwarded along.

I noticed in the Release notes for Orion 9.1 this note:

* The source field of forwarded Syslog messages is now correctly populated with the IP address of the Syslog message source, instead of the IP address of the forwarding Orion NPM server.

I do have Orion 9.1 with SP1 installed, and yet I still see the Solarwinds Syslog Server being the sender, and not having it show the originating Hostname/IP.

Can someone shed some light on this?
Thank you,
Stephen

bshopp · Answer

This is correct, see this post here

terrys1026 · Answer

Syslog forwarding with source address spoofing is in the list of features currently being developed, according to the NPM posting by Brandon.

I also use syslog-ng to do filtering, forwarding, and source address spoofing.  I run it on RHEL3/5.  I found that Centos 5.3 dropped a significant number of UDP packets between the ethernet driver and syslog-ng.  Tcpdump verified that the udp packets arrived, but they were never logged by syslog-ng.  So I don't recommend Centos for a syslog server.  The syslog-ng mailing list also had comments about UDP drops from someone running Solaris.

baskervi · Answer

I'm trying to do exactly what the original poster was trying to do. That is, I need to forward incoming syslog messages to a central syslog server, where the messages appear to come from the originating host and not from the Solarwinds server.

Thanks for any input.