Hello Support-Team,
we are using the HAProxy as load balancer for our Graylog servers.
The TCP based protocols works fine, but we have some trouble with the syslog
forwarding.
Our configuration file haproxy.cfg looks like this:
log-forward syslog
# accept incomming UDP messages
dgram-bind 10.1.2.50:514 transparent
# log message into ring buffer
log ring@logbuffer format rfc5424 local0
ring logbuffer
description "buffer for syslog"
format rfc5424
maxlen 1200
size 32764
timeout connect 5s
timeout server 10s
# send outgoing messages via TCP
server logserver1 10.1.2.44:1514 log-proto octet-count check
#server logserver1 10.1.2.44:1514 log-proto octet-count check source
0.0.0.0 usesrc clientip
The syslog messages are forwarded to the logserver1 10.1.2.44. Unfortunately
some older Cisco switches did not send the hostname or IP address in the syslog
packet.
Is there any chance to route the client IP though the ringbuffer to the
logserver1?
The command source is not allowed in the ring section. If I uncomment the last
line no data is send to the logserver1.
Best regards,
Sören Hellwig
Dipl.-Ing. (FH) technische Informatik
Abteilung IT Basis - Team Basistechnologien
[UKE_Dachmarke_RGB_200]
Universitätsklinikum Hamburg-Eppendorf
Geschäftsbereich Informationstechnologie
Martinistraße 52
Gebäude O36 / 1.OG / Raum 16<https://osm.org/go/0HoHlXpgK?m=>
20246 Hamburg
Telefon: +49 (0)40 7410-57552
Mobil: +49 (0)152-22837423
s.hell...@uke.de<mailto:s.hell...@uke.de>
www.uke.de<http://www.uke.de/>
--
_____________________________________________________________________
Universitätsklinikum Hamburg-Eppendorf; Körperschaft des öffentlichen Rechts;
Gerichtsstand: Hamburg | www.uke.de
Vorstandsmitglieder: Prof. Dr. Christian Gerloff (Vorsitzender), Joachim Prölß,
Prof. Dr. Blanche Schwappach-Pignataro, Marya Verdel
_____________________________________________________________________
SAVE PAPER - THINK BEFORE PRINTING
