[syslog-ng] Spoof-source issue

Balazs Scheidler bazsi at balabit.hu
Fri Aug 5 11:04:19 CEST 2005


On Thu, 2005-08-04 at 14:43 -0600, Jose Gerardo Amaya Giron wrote:
> Hello all. I'm using the spoof source feature to centralize my logs to a server.
> I was hoping that the server will receive the IP message with the source IP
> address from the source(spoofed of course), but it get it as the source address
> the syslog-ng server and the spoofed IP address in the message content. Is there
> a way I can generate the message not with the original source IP as a
> description, but to have it actually as the IP message.

* spoof_source supports UDP only
* you need to run syslog-ng as root for spoof_source to work
* if there's an error in spoof-source sending, UDP falls back to
non-spoofed sending

-- 
Bazsi



More information about the syslog-ng mailing list