syslog forwarding

At present I'm sending syslog from my routers to Solarwinds.

This works like a charm, however I want to forward denied ACL entries to another syslog server.

I see the Actions allow to for this and that works, however when reviewing the forwarded syslog message on other Ssyslog Server,
I see the source being Solarwinds.

I want the source to reflect the orginal host that sent the message.

I might dreaming, but is this possible.... thanks

Find more posts tagged with

Accepted answers

chris.lapoint

Please see:

All comments

iceman

SW support tells me this is not possible with their Syslog Server.

Network_Guru

Kiwi Syslogger supports this.
So you could send the ACL denies to Kiwi & forward everything else to Solarwinds from Kiwi.

-=Cheers=-
NG

I hate to differ with the Network Guru, but I don't think even Kiwi does this. What iceman is asking for is the Orion Syslog Service to spoof the IP address of the original message when forwarding. The Orion Syslog Service cannot spoof an IP address, but I don't see Kiwi doing that either.

BK
Nobody Special

Network_Guru

BK is correct. Technically it is not possible, but here is how Kiwi does it;

Retain the original source address of the message

Normally, the syslog protocol is unable to maintain the original senders address when forwarding/relaying syslog messages. This is because the senders address is taken from the received UDP or TCP packet.

The way Kiwi Syslog gets around this problem is to place a tag in the message text that contains the original senders address. The tag looks like Original Address=192.168.1.1. That is, the "Original Address=" tag, followed by the IP address, followed by a space delimiter.

This tag is only inserted if the "Retain the original source address of the message" option is checked.

I think Orion could be setup to do something similar.

-=Cheers=-
NG

kindbro

This is an old post, but with the acquisition of KIWI can syslogs be forwarded from NPM to a syslog client and give you the ability see the original name.

Currently, when I get a syslog on my pc using the engineers addition syslog viewer all logs have the hostname of my Orion syslog server as indicated above. It would be awesome if we can retain the original source of the log.

Thanks in advance.

chris.lapoint

Please see: