Perhaps there's a better way, but...
You could give your log server multiple ip addresses, and then bind your sources explicitly:
source s_1 { udp( ip(192.168.1.20) flags(no_parse) ); }
source s_2 { udp( ip(192.168.1.21) ); };
Then configure a different syslog server address into each device depending on whether you want to run the logs through the parser or not.
Good idea but I can't add another IP address... http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/htnmsylg.html
Thank you for the documentation !
Regards, Yann I. 2010/11/10 Matthew Hall <mhall@mhcomputing.net>
On Wednesday, November 10, 2010 05:57:34 Yann I. wrote:
For the route Cisco, I don't know if it's possible or not...
It's possible to change the destination port on Cisco.
Check out the documentation:
logging host 209.165.201.1 transport udp port 601
http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/htnmsylg.html
-- Matthew Hall