RE: [syslog-ng] ng to ng then to syslog
I agree with the previous poster, why indeed use another (lesser) syslog ;-) But if you insist: Try with the 'spoof_source(yes)' as option in your tcp(... <options>). I also learned that localip() can be used to force a certain local ip, but I don't think that applies to your setup. Ref: http://www.balabit.com/products/syslog_ng/reference-2.0/syslog-ng.html/i ndex.html#destinations 'luck! Frans -----Original Message----- From: Gerardo Amaya [mailto:joseg@galileo.edu] Sent: Friday, July 29, 2005 11:10 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] ng to ng then to syslog Hello all. First thanks for all the help on first issue, it was some stupid filter. I'm configured to send syslog messages from server1 to server2 both with syslog-ng. Now what I need is to pass messages from server1 to server2 via syslog-ng(already done that) and as soon as the event gets in syslog-ng of server2 to send it to syslog daemon in server2. I have also done that but the problem is that the events appear as they are coming locally and not from server1. Is there a way to change that? thanks in advance Gerardo Amaya _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
On Tue, 2005-08-02 at 00:37 +0200, Frans Stekelenburg wrote:
I agree with the previous poster, why indeed use another (lesser) syslog ;-) But if you insist:
Try with the 'spoof_source(yes)' as option in your tcp(... <options>). I also learned that localip() can be used to force a certain local ip, but I don't think that applies to your setup.
spoof_source only works with udp() -- Bazsi
Balazs Scheidler wrote:
On Tue, 2005-08-02 at 00:37 +0200, Frans Stekelenburg wrote:
I agree with the previous poster, why indeed use another (lesser) syslog ;-) But if you insist:
Try with the 'spoof_source(yes)' as option in your tcp(... <options>). I also learned that localip() can be used to force a certain local ip, but I don't think that applies to your setup.
spoof_source only works with udp()
The manual says tcp() and udp(), can you please confirm on that so I can plan my installation enviroment. thanks in advance Gerardo Amaya
On Tue, 2005-08-02 at 09:26 -0400, Gerardo Amaya wrote:
Balazs Scheidler wrote:
On Tue, 2005-08-02 at 00:37 +0200, Frans Stekelenburg wrote:
I agree with the previous poster, why indeed use another (lesser) syslog ;-) But if you insist:
Try with the 'spoof_source(yes)' as option in your tcp(... <options>). I also learned that localip() can be used to force a certain local ip, but I don't think that applies to your setup.
spoof_source only works with udp()
The manual says tcp() and udp(), can you please confirm on that so I can plan my installation enviroment.
Here is the documentation that I see: <entry>spoof_source</entry> <entry>yes or no</entry> <entry> Enables source address spoofing. This means that the host running syslog-ng generates UDP packets with the source IP address matching the original sender of the message. It is useful when you want to perform some kind of preprocessing via syslog-ng then forward messages to your central log management solution with the source address of the original sender. This option only works for UDP destinations though the original message can be received by TCP as well. This option is only available if syslog-ng was compiled using the --enable-spoof-source configure option. </entry> -- Bazsi
participants (3)
-
Balazs Scheidler
-
Frans Stekelenburg
-
Gerardo Amaya