This was added as of the latest edition of NPM. The syslog server can forward messages to a second syslog server and retain the original senders ip address. Basically they copied the feature directly out of Kiwi.
That's fine for the ones that can and custom code that programmers have been smart enough to handle such. Will have to work around I guess.
Or you can wait for someone to give you a different answer. I'm sure someone else will weigh in.
It would be nice to a have special action added to the Solarwinds syslog server, that will forward in a special format that triggers Solarwinds products to bring in the message so it looks like the original from the device.
I believe that feature will be coming at some point. The Kiwi product did that and I'm assuming there are plans to bring the majority of that functionality to NPM.
As for the syslog, why do you want the syslog on both servers? Is it just to trigger the configuration download? If so, I think it might be easier if you remotely trigger it for those specific messages.
Point all your syslogs at a Kiwi Syslog server, and use Kiwi to redirect the syslogs to as many back-end syslog targets as you need. Combined with WinPcap, Kiwi can redirect the syslogs with forged source IP addresses, so that the receiving targets aren't aware they're receiving forwarded messages. Just be sure you don't have any IP-spoofing rules on your routers / switches / firewalls if the Kiwi server and the NPM/NCM aren't on the same subnet.
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 150,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process. Learn more today by joining now.