<div dir="ltr"><div>Hi Laci,</div><div><br></div><div>Thanks for your comments and help.</div><div>Bellow the details of my problem!</div><div><br></div><div>Any help is very appreciated.<br></div><div><br></div><div><b>So I want to read from the interface:</b></div><div></div><div>20: INTRA-CH@eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000<br> link/ether 08:00:27:79:1c:f5 brd ff:ff:ff:ff:ff:ff<br> inet <a href="http://127.10.10.1/22">127.10.10.1/22</a> brd 127.1.3.255 scope host INTRA-CH<br> valid_lft forever preferred_lft forever<br><b><br></b></div><div><b>I want to write to the interface:</b></div><div>30: EXT@eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9216 qdisc noqueue <b>master MGMT</b> state UP group default qlen 1000<br> link/ether 1a:07:cf:e2:28:ca brd ff:ff:ff:ff:ff:ff</div><div> inet <a href="http://192.168.1.132/24">192.168.1.132/24</a> brd 192.168.1.255 scope global
EXT
<br> valid_lft forever preferred_lft forever<br></div><div> inet6 fe80::8bd5:aa6a:9510:7418/64 scope link stable-privacy<br> valid_lft forever preferred_lft forever</div><div><br></div><div><b>syslog-ng in running as a service in Debian10.</b></div><div><br></div><div><b>Configurations of syslog-ng for the source are:</b></div><div><span style="font-family:monospace">source s_src {<br> system();<br> internal();<br> syslog(ip(127.1.1.1) transport("udp") port(514) keep-alive(no));<br>};</span></div><div><br></div><div><b>Configurations of
syslog-ng for the destination are:</b></div><div><span style="font-family:monospace">destination d_test1_udp {<br> syslog("192.168.1.88" transport("udp") ip-protocol(4) port(514) keep-alive(no) localip("192.168.1.132")<br> suppress(5)<br> );<br>};<br>filter f_remote_test1_udp_authpriv {<br> facility(authpriv) and level(debug .. emerg);<br>};<br>filter f_remote_test1_udp_local1 {<br> facility(local1) and level(debug .. emerg);<br>};<br>filter f_remote_test1_udp_local2 {<br> facility(local2) and level(debug .. emerg);<br>};<br>filter f_remote_test1_udp_local6 {<br> facility(local6) and level(debug .. emerg);<br>};<br>filter f_remote_test1_udp {<br> filter(f_remote_test1_udp_authpriv) or filter(f_remote_test1_udp_local1) or filter(f_remote_test1_udp_local2) or filter(f_remote_test1_udp_local6); };<br>log {<br> source(s_src);<br> filter(f_remote_test1_udp);<br> destination(d_test1_udp);<br>};</span><br>
</div><div><br></div><div><b>I got the syslog-ng log:</b></div><div><b><span style="font-family:monospace">Jul 22 17:01:10 localhost syslog-ng[14253]: [2020-07-22T17:01:10.448970] WARNING: With use-dns(no), dns-cache() will be forced to 'no' too!;<br>Jul 22 17:01:10 localhost syslog-ng[14253]: [2020-07-22T17:01:10.450299] Current position not matches to the saved cursor position, seek to head; cursor='s=eabbca1417cd46a398b5e6593d62<br>Jul 22 17:01:10 localhost syslog-ng[14253]: [2020-07-22T17:01:10.463249] Error binding socket; addr='AF_INET(192.168.1.132:0)', error='Cannot assign requested address (99)'<br>Jul 22 17:01:10 localhost syslog-ng[14253]: [2020-07-22T17:01:10.463974] Initiating connection failed, reconnecting; time_reopen='60'</span></b><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jul 22, 2020 at 10:20 AM Laszlo Szemere (lszemere) <<a href="mailto:Laszlo.Szemere@oneidentity.com">Laszlo.Szemere@oneidentity.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Hello Alex,</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
I read a tutorial about VRF's. (To be honest I have never worked with them before.)</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12pt"> From your current description it is not clear to me, where is syslog-ng on your network. Can you please provide some topology information?</span><br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
In the meantime (if my assumption is right about your use case):</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
By default, a syslog-ng network source will listen on all available interfaces. You can specify the IP address to bind to, with the "ip()" option.</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Similarly network destinations will bind to "0.0.0.0" by default, which can be overwritten by the "localip()" option.</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Best regards,</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Laci</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id="gmail-m_-7312434110780448330appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_-7312434110780448330divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>> on behalf of Alexandre Santos <<a href="mailto:alexandre.rosas.santos@gmail.com" target="_blank">alexandre.rosas.santos@gmail.com</a>><br>
<b>Sent:</b> Tuesday, July 21, 2020 16:18<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> [syslog-ng] syslog-ng multiple VRF</font>
<div> </div>
</div>
<div>
<div style="background-color:rgb(255,235,156);width:100%;border-style:solid;border-color:rgb(156,101,0);border-width:1pt;padding:2pt;font-size:10pt;line-height:12pt;font-family:"Calibri";color:black;text-align:left">
<span style="color:rgb(156,101,0);font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div dir="ltr">
<div>Hi All,</div>
<div><br>
</div>
<div>I have a question regarding syslog-ng and VRF.</div>
<div>I want to read from a syslog source, which interface is in the default VRF, and send the logs to a syslog/network destination interface which is in a MGMT VRF.</div>
<div><br>
</div>
<div>Can syslog-ng support this?</div>
<div>If yes, what are the aspects I should be careful about?<br>
</div>
<div><br>
</div>
<div>Thanks and regards,</div>
<div>Alex<br>
</div>
</div>
</div>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>