X-Forwarded-For is an http header, so not applicable to syslog-ng.

If there's indeed a tcp option that would be doable, do you have a documentation about that?

Also, f5 would not really do load balancing as it assumes that there are many, short lived connections, whereas syslog is a long term connection.

All an f5 is doing is monitoring the nodes and react if one of them fails.

On Thu, Aug 6, 2020, 17:21 Peter Griggs <peter@petergriggs.co.uk> wrote:

Hello

 

Does anyone have any experience of syslog-ng behind F5 load balancer and preserving source IP address? The F5 can put the X-Forwarding header or TCP Options value but I don't believe syslog-ng can understand either of these - Am I wrong? If I am then I am assuming I can have a filter that overwrites $HOST with the value of X-Forwarding or TCP Options.

 

Any help appreciated.

 

Thanks

Peter.

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq