Return
-
Title
Load-balancer Replaces Host in Logs -
Description
After sending logs through a load-balancer then to a Syslog-ng PE server or Syslog-ng Store Box, the IP Address and/or Host is overwritten with that of the load-balancer and not the originating source. -
Cause
The load-balancer is rewriting the ${HOST} which contains the Hostname or IP Address of the originating source. -
Resolution
One Identity Support is not available to provide support for load-balancers, please consult with local IT services to ensure the load-balancer does not rewrite parts of the log header.
Workaround: If the ${MESSAGE} of the log contains the Hostname and/or IP Address of the originating host it is possible, using the CSV parser and Rewrite rules, to take the Hostname or IP Address and rewrite the ${HOST} with this information.
For more information on the CSV parser and Rewrite rules please see the latest version of the Syslog-ng PE Admin guide and as always, if any issues are encountered please reach out to the One Identity support team.