Adding SourceIP to Logs (4239136)

In a client --> relay --> server (not syslog-ng) infrastructure, the server sets the relay's address as source IP.

Notes

• Consider, that the exact solution depends on the configuration of the server application and the log format.
• The solutions uses SOURCEIP macro, that is the IP address of the host that sent the message to syslog-ng.
• SOURCEIP macro can be used to send the information another way, for example in SDATA. See 'Example: Rewriting custom SDATA fields'.

Example 1 - Template function

In this example the,

• a non-syslog message is sent to the server
• syslog-ng relay adds 'SourceIP=SOURCEIP' kv-pair to the beginning of message
• server application parses the kv-pair to get the source IP
  

Add the following line in the destination of the syslog-ng configuration file:

template("SourceIP=${SOURCEIP} ${MSG}\n")

It should look similar to the following example:

destination {
    network(
        "10.10.10.10"
        port(1000)
        transport("tcp")
        template("SourceIP=${SOURCEIP} ${MSG}\n")
    );
};

Example 2 - Rewrite rule

In this example the,

• a BSD syslog message is sent to the server
• syslog-ng relay adds 'SourceIP=SOURCEIP' kv-pair to the beginning of message part of the log.
  
• server application parses the kv-pair to get the source IP

Create the following rewrite rule and add to the relevant log path:

rewrite r_sourceip{
    set('${SOURCEIP} ${MSG}' value(MESSAGE));
};

It should look similar to the following example:

log {
    source(s_net);
    rewrite(r_sourceip);
    destination(d_messages);
};