<div><div class="gmail_quote">On Tue, Feb 2, 2010 at 7:43 AM, Clayton Dukes <span dir="ltr"><<a href="mailto:cdukes@gmail.com">cdukes@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Also,<br>
After looking at the documentation for 2.0, I see an option for:<br>
spoof_source<br>
<br>
I'm a bit confused here since I've always just used keep_hostname and<br>
it seems to provide the correct source.<br>
What does spoof_source provide that keep_hostname doesn't?<br>
<br>
Doesn't keep_hostname replace the header with the original source<br>
before forwarding it to the central syslog-ng server?<br>
<div><div></div><div class="h5"><br>
<br>
<br>
On Tue, Feb 2, 2010 at 9:29 AM, Clayton Dukes <<a href="mailto:cdukes@gmail.com">cdukes@gmail.com</a>> wrote:<br>
> Hey guys,<br>
> I have a customer that is running v2.09 (with security patches). We<br>
> need them to forward logs to our syslog-ng server but need to keep the<br>
> original device as the source name.<br>
><br>
> I'm assuming this is what they need:<br>
> keep_hostname(yes);<br>
> chain_hostnames(no);<br>
><br>
> Can anyone confirm that v2.09 supports this?<br>
> Is there anything else needed to accomplish this in v2.09?<br>
><br>
><br>
><br>
> --<br>
> ______________________________________________________________<br>
><br>
> Clayton Dukes<br>
> ______________________________________________________________<br>
><br>
<br>
<br>
<br>
--<br>
______________________________________________________________<br>
<br>
Clayton Dukes<br></div></div></blockquote><div><br></div><div> </div></div>Hey Clayton,<div><br></div><div>Yep, syslog-ng 2.0 supports keep_hostname(). As a simple explanation, keep_hostname(yes) simply preserves whatever is in the second column of an incoming message. By the sounds of it, your client should be using it throughout any syslog-ng relays or hops and you should be using it on your receiving end. When keep_hostname(no) is used, syslog-ng sets the host column to be whatever IP it received the message from. Also keep in mind that keep_hostname() (along with other formerly global options) can be used in a source {} definition starting with syslog-ng 3.x , so if you have multiple clients relaying stuff to you on several different ports, you may have more flexibility by using versions 3.x.</div>
<div><br></div><div>Using spoof source, syslog-ng will re-write a UDP packets source address prior to forwarding it on to its next destination, so the endpoint syslog box *thinks* it got it from someone else (since UDP is connectionless, this is possible). It doesn't sound like you need this feature in your scenario.</div>
<br>-- <br>Lance Laursen<br>Demonware Systems Engineer<br>
</div>