Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Orion Log Viewer - Syslog Forwarding Behavior Change

Good afternoon,

It appears that after installing the Orion Log Viewer during a 2017.X -> 2020.2.5 upgrade earlier this month, there's been a change to the way Syslog messages are forwarded. OR, I just don't know how to find the setting I'm looking for

Prior to the upgrade (and installation of the OLV plugin), the forwarded syslogs from the legacy Syslog Viewer contained an "Original address = X.X.X.X". SInce the upgrade, and setting up the same forwarding rules in OLV, this piece of info is missing. Is this expected behavior? Our SIEM team was inquiring about it, since they now need to adjust their parsing rules to handle the change.

Find more posts tagged with

Accepted answers

aLTeReGo

Looking at the release notes, it appears this option was added in the 2020.2.6 release

All comments

aLTeReGo

In you rule have you selected both 'Use the original sender's address as the source address' as well as 'Use the original sender's address for the HOSTNAME field' as described here > documentation.solarwinds.com/.../lm-log-forwarding.htm

svindle

So that looks like exactly what I need...However, I'm missing the Syslog HOSTNAME and Syslog ORIGINAL ADDRESS field options?

aLTeReGo

Looking at the release notes, it appears this option was added in the 2020.2.6 release

svindle

This was the correct answer. Upgraded to 2020.2.6, and that brought along the fields we needed. Thanks for pointing me in the right direction!