This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Log Analyzer Mapping hostname/Source IP from syslog message

We have syslog collection setup with Kiwi as first syslog collection point and Solarwinds Orion running behind Kiwi as 2nd syslog point. Kiwi will forward only filtered message to Solarwinds.

Linux client will sent syslog messages to Load balancer IP, and LB will forward it to available kiwi server, Due to which at KSS, the source Ip of the syslog messages mostly will be the Load balancer IP. In order to correct this, we have directed Kiwi to update the hostname from the 4th argument from syslog message, using script. And it is working as expected


But when we forward this message to Solarwinds, by default the Source IP --> Load balancer Ip is getting mapped in LA console.

P.s : We already enabled retain ip property in Kiwi.

Looking for some directions here