Home / server / Questions / 1040972
Accepted
Roald Nefs
Asked: 2020-11-03 05:32:20 +0800 CST

Rsyslog forward using original source IP over TLS

  • 772

I'm trying to forward all syslog messages over TLS from our enviroment to an external syslog server (dest.syslog.example.com) using rsyslog. Unfortunately the source IP is changed to that of the relay host (fwd.syslog.example.com). I would like it to send the original source IP instead of the IP of the relay host while adhering to the RSYSLOG_SyslogProtocol23Format format.

Current rsyslog configuration relevant for forwarding the syslog messages over TLS:

$DefaultNetstreamDriverCAFile /etc/pki/tls/private/ca.crt
# Run driver in TLS mode
$DefaultNetstreamDriver gtls
$ActionSendStreamDriverMode 1
$ActionSendStreamDriverAuthMode x509/name

$ActionSendStreamDriverPermittedPeer dest.syslog.example.com
$LocalHostName fwd.syslog.example.com
# Forward logging
*.* @@(o)dest.syslog.example.com:6514;RSYSLOG_SyslogProtocol23Format

Would it be possible to modify the fromhost-ip to the original source IP?

ssl syslog rsyslog

1 Answers

  1. Best Answer

    I'm not sure if this is sufficient, but the built-in template RSYSLOG_SyslogProtocol23Format is defined as

    "<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% 
 %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n"

    and you can replace HOSTNAME by fromhost or fromhost-ip:

    template(name="myFormat" type="string"
   string="<%PRI%>1 %TIMESTAMP:::date-rfc3339% %fromhost% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n")
*.* @@(o)dest.syslog.example.com:6514;myFormat
    • 1