Forward logs from Kiwi to Solarwinds SEM and keep source IP Unchanged

Question

Hi everyone,

I am trying to deploy a complex system because we have different locations which are connected through VPN site to site. I thought was better to install a local syslog to each of the sites and forward the logs to Solarwinds SEM.

I am using Kiwi Syslog server on each site and configured the forwarding rules. What i do not like about this implementation is that the logs in Solarwinds SEM are showing as they are coming from Kiwi and not from actual device. I can not understand what is that log linked too. I am sending logs to Kiwi from Sonicwall, different switches, but when those are forwarded to Solarwind SEM are showing as single IP ( Kiwi IP).

Does anyone has any experience how to configure the local Syslog and forward the logs to Solarwinds SEM but keep the original source IP? I want to follow this model here : https://documentation.solarwinds.com/en/success_center/sem/content/admin_guide/1.0-understanding_sem/sem-deployment-complex-with-syslog.htm

Thank you

Brian

yaquaholic · Accepted Answer

Hi Brian,

You can set the forwarder to retain the original IP addresses. Have a look at:
https://documentation.solarwinds.com/en/success_center/kss/content/kss_adminguide_action_to_forward_to_host.htm
In the Rules optional values you'll find:

Retain the original source address of the message

Normally, the syslog protocol is unable to maintain the original sender's address when forwarding syslog messages. This is because the sender's address is taken from the received UDP or TCP packet. Kiwi Syslog solves this problem by placing a tag in the message text that contains the original sender's address.

HIH,

Rich

Forward logs from Kiwi to Solarwinds SEM and keep source IP Unchanged

Top Replies