0

I'm working on rsyslog.conf upon CentOS 6.2.

Is there any configuration in rsyslog.conf to change the source interface (eg - eth0, eth1), so that the messages being sent to syslog server contains the same source IP address (which is obtained from the "source interface" mentioned)?

slm
  • 7,615
  • 16
  • 56
  • 76
Revathy
  • 11
  • 2

1 Answers1

0

For outgoing connections the source interface is usually determined according to your routing tables. If you do ip route show you should get some output similar to this:

default via 10.70.0.1 dev wlan0  metric 2003 
10.20.0.0/16 dev ppp0  scope link 
10.60.2.10 dev ppp0  proto kernel  scope link  src 10.60.2.15 
10.70.0.0/16 dev wlan0  proto kernel  scope link  src 10.70.0.100  metric 2003 
127.0.0.0/8 via 127.0.0.1 dev lo 
222.44.42.55 via 10.70.0.1 dev wlan0  src 10.70.0.100

In this snippet you see a list of destination networks on the left side, and after the dev keyword you see which outgoing interface is going to be used for outgoing packets to this destination.

If you want to modify this behaviour you can change your routes by using the ip utility, for this you can check man ip-route. Another way which is more powerful but also more complicated would be to create specific routing rules, you can see more about that in man ip-rule.

replay
  • 3,240
  • 14
  • 17
  • Hi, Thanks for the prompt reply.Thanks a lot:) One more small query.. I want to know if the "changing of routes" can be made specific only to "syslog packets"? Is there any configuration in rsyslog to facilitate this ? – Revathy Aug 20 '13 at 12:35
  • Since the `ip` utility and the routing are working only on IP level, they can only create rules based on combinations of src host and dst host. I don't think you can specify any source host inside the rsyslog configuration itself, and in most circumstances this shouldn't be necessary. So I would like to ask why you have this requirement of specifying a different source interface just for one service? – replay Aug 20 '13 at 13:08
  • My requirement is to "set all system logging (syslog) messages being sent to syslog servers to contain the same IP address, regardless of which interface the syslog message uses to exit the router". This i need to do by specifying the source interface(eth0 or eth1). – Revathy Aug 21 '13 at 03:47