<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7652.24">
<TITLE>Host/IP Macros in relay chains</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT FACE="Times New Roman">Question on Host/IP Macros in relay chains.</FONT>
</P>
<P><FONT FACE="Times New Roman">Is there a way to present the original sender IP on a final relay in a chain of several relays ?</FONT>
</P>
<P><FONT FACE="Times New Roman">With hostname, the FULLHOST and HOST macros are capable of doing this (with tuning of keep_hostname() and chain_hostnames() ) </FONT></P>
<P><FONT FACE="Times New Roman">Their corresponding FULLHOST_FROM and HOST_FROM marcos exhibit the same behaviours as the SOURCEIP macro in the sense that they only provide the NAME/IP of the previous relay .</FONT></P>
<P><FONT FACE="Times New Roman">I have read Michael Gehrmann's post " </FONT><A HREF="https://lists.balabit.hu/pipermail/syslog-ng/2004-November/006695.html"><U><FONT COLOR="#0000FF" FACE="Times New Roman">https://lists.balabit.hu/pipermail/syslog-ng/2004-November/006695.html</FONT></U></A><FONT FACE="Times New Roman"> " </FONT>
<BR><FONT FACE="Times New Roman">which discusses the compile time option "--enable-spoof-source" feature which spoofs the sourceip using UDP but this doesn't really help as I need to use tcp and retain the relay's source (firewalls in the chain). Presumably this setting would also be required on all members of the relay chain.</FONT></P>
<P><FONT FACE="Times New Roman">I guess I am really looking for an alternative way to achieve similar effect to Michael's solution using the first (original) entry in the chain (rather than spoofing the last entry in the chain at all points through the chain) however to force an IP from the original sender's entry in the chain (Reverse/PTR DNS resolution perhaps ??). </FONT></P>
<P><FONT FACE="Times New Roman">What HOST_FROM is-to HOST, SOURCEIP is-to what I want.</FONT>
</P>
<BR>
<P><FONT FACE="Times New Roman">Does anyone know whether this is currently possible (or pipeline development) ? </FONT>
<BR><FONT FACE="Times New Roman">Maybe in the premium version (although I can't see it documented there either)???</FONT>
</P>
<BR>
<P><FONT FACE="Times New Roman">Thanks,</FONT>
</P>
<P><FONT FACE="Times New Roman">Philip</FONT>
</P>
<BR>
<BR>
<P><FONT FACE="Times New Roman">Excerpts from the syslog-ng-v2.0 admin guide (section 9.5 Macros)</FONT>
</P>
<P><FONT FACE="Times New Roman">FULLHOST:</FONT>
<BR><FONT FACE="Times New Roman">The full FQDN of the host name chain (without trimming chained hosts), including</FONT>
<BR><FONT FACE="Times New Roman">the domain name. To use this macro, make sure that the</FONT>
<BR><FONT FACE="Times New Roman">keep_hostname() option is enabled.</FONT>
</P>
<P><FONT FACE="Times New Roman">FULLHOST_FROM:</FONT>
<BR><FONT FACE="Times New Roman">FQDN of the host that sent the message to syslog-ng as resolved by syslogng</FONT>
<BR><FONT FACE="Times New Roman">using DNS. If the message traverses several hosts, this is the last host in</FONT>
<BR><FONT FACE="Times New Roman">the chain. To use this macro, make sure that the keep_hostname() option</FONT>
<BR><FONT FACE="Times New Roman">is enabled.</FONT>
</P>
<P><FONT FACE="Times New Roman">HOST:</FONT>
<BR><FONT FACE="Times New Roman">The name of the source host where the message originates from. If the message</FONT>
<BR><FONT FACE="Times New Roman">traverses several hosts and the chain_hostnames() option is on,</FONT>
<BR><FONT FACE="Times New Roman">the first host in the chain is used. To use this macro, make sure that the</FONT>
<BR><FONT FACE="Times New Roman">keep_hostname() option is enabled.</FONT>
</P>
<P><FONT FACE="Times New Roman">HOST_FROM:</FONT>
<BR><FONT FACE="Times New Roman">Name of the host that sent the message to syslog-ng, as resolved by syslogng</FONT>
<BR><FONT FACE="Times New Roman">using DNS. If the message traverses several hosts, this is the last host in</FONT>
<BR><FONT FACE="Times New Roman">the chain. To use this macro, make sure that the keep_hostname() option</FONT>
<BR><FONT FACE="Times New Roman">is enabled.</FONT>
</P>
<P><FONT FACE="Times New Roman">SOURCEIP:</FONT>
<BR><FONT FACE="Times New Roman">IP address of the host that sent the message to syslog-ng. (I.e. the IP address</FONT>
<BR><FONT FACE="Times New Roman">of the host in the FULLHOST_FROM macro.) Please note that when a message</FONT>
<BR><FONT FACE="Times New Roman">traverses several relays, this macro contains the IP of the last relay.</FONT>
</P>
<P><pre wrap>==============================================================================
Please access the attached hyperlink for an important electronic communications disclaimer:
http://www.credit-suisse.com/legal/en/disclaimer_email_ib.html
==============================================================================
</pre></P></BODY>
</HTML>