Forum Discussion

Banana_281411's avatar
Banana_281411
Icon for Nimbostratus rankNimbostratus
Apr 25, 2017

How can I change my syslog packets' source IP addr?

hello,The following is my syslog configuration:

modify syslog {
    auth-priv-from notice
    auth-priv-to emerg
    cron-from warning
    cron-to emerg
    daemon-from notice
    daemon-to emerg
    description none
    include "
    filter f_remote_loghost {
        level(warn..emerg);
    };

    destination d_remote_loghost {
        udp(\"10.x.x.x\" port(514));
    };

    log {
        source(s_syslog_pipe);
        filter(f_remote_loghost);
        destination(d_remote_loghost);
    };
    "
    iso-date disabled
    kern-from notice
    kern-to emerg
    mail-from notice
    mail-to emerg
    messages-from notice
    messages-to warning
    remote-servers none
    user-log-from notice
    user-log-to emerg
}

I capture packets and I find the source IP addr is the selfIP. How can I force the source IP addr into the mgmt IP? Can I change "source(s_syslog_pipe)" to "source(192.168.1.245)"?

PS:mgmt interface is down,I can not write a Detailed Routing,I just want force the source addr into mgmt IP addr.

Thanks!

1 Reply

  • I find the answers by myself:

    include "
    filter f_remote_loghost {
        level(warn..emerg);
    };
    
    destination d_remote_loghost {
        udp(\"10.x.x.x\" port(514) localip(192.168.1.245));
    };
    source s_syslog_pipe {
        local-ip 192.168.2.245
    }
    
    log {
        source(s_syslog_pipe);
        filter(f_remote_loghost);
        destination(d_remote_loghost);
    };
    "