[syslog-ng] Sylog-ng and F5 Load balancer.

[Balazs Scheidler]

It seems f5 (and akamai) can send the ip address as IP option 28 by
overloading its meaning. This could be added to syslog-ng as well.

On Thu, Aug 6, 2020, 21:28 Balazs Scheidler <bazsi77 at gmail.com> wrote:

> X-Forwarded-For is an http header, so not applicable to syslog-ng.
>
> If there's indeed a tcp option that would be doable, do you have a
> documentation about that?
>
> Also, f5 would not really do load balancing as it assumes that there are
> many, short lived connections, whereas syslog is a long term connection.
>
> All an f5 is doing is monitoring the nodes and react if one of them fails.
>
> On Thu, Aug 6, 2020, 17:21 Peter Griggs <peter at petergriggs.co.uk> wrote:
>
>> Hello
>>
>>
>>
>> Does anyone have any experience of syslog-ng behind F5 load balancer and
>> preserving source IP address? The F5 can put the X-Forwarding header or TCP
>> Options value but I don't believe syslog-ng can understand either of these
>> - Am I wrong? If I am then I am assuming I can have a filter that
>> overwrites $HOST with the value of X-Forwarding or TCP Options.
>>
>>
>>
>> Any help appreciated.
>>
>>
>>
>> Thanks
>>
>> Peter.
>>
>> ______________________________________________________________________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation:
>> http://www.balabit.com/support/documentation/?product=syslog-ng
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20200806/f68f81db/attachment.html>