2

How do i get rsyslog to mirror traffic unmodified (including origin IP) to another port?

I have many devices sending data into port 514 but i need two different applications on the server to receive that data.

I tried adding the following to the bottom of /etc/rsyslog.conf

*.* @@127.0.0.1:1514

# also tried
*.* @127.0.0.1:1514

The application listening on 1514 get's all the data but the source address is always 127.0.0.1. If i send logs directly to port 1514 the application listening at 1514 see's the correct source address but now rsyslog doesn't see the data since it's listening on port 514.

How do i get rsyslog to mirror traffic unmodified (including origin IP) to another port?

For whatever reason the following iptables rules as an alternative to the above are not redirecting traffic on Ubuntu server 18.04LTS to resolve the problem so i was hoping there was a way to tweak my /etc/rsyslog.conf to make sure 1514 saw the original source instead of 127.0.0.1.

Example alternative iptables rule that isn't mirroring traffic (or at least graylog can't see it). 

iptables -t mangle -A PREROUTING -p tcp --dport 514 -j TEE --gateway 127.0.0.2
iptables -t nat -A PREROUTING -d 127.0.0.2 -p tcp --dport 514 -j DNAT --to 127.0.0.1:1514

iptables -t mangle -A PREROUTING -p udp --dport 514 -j TEE --gateway 127.0.0.2
iptables -t nat -A PREROUTING -d 127.0.0.2 -p udp --dport 514 -j DNAT --to 127.0.0.1:1514

Note that my ufw rules are 22 ALLOW Anywhere and 514 ALLOW Anywhere

jtlindsey
  • 323
  • 1
  • 6
  • 16
  • *. * ....do you have a space between the dot and the 2nd asterisk? – Sirch Apr 29 '19 at 15:31
  • no. i'll add it and see what happens and update. – jtlindsey Apr 29 '19 at 15:37
  • no, using `*. *` (astrix dot space astrix) throws error and stops rsyslog service `error during parsing file /etc/rsyslog.conf, on or before line 61: warnings occured in file '/etc/rsyslog.conf' around line 61 [ invalid character in selector line - ';template' expected [v8.32.0]` – jtlindsey Apr 29 '19 at 15:42
  • Yes, sorry - it shoudnt be there, I thought I saw one. I'm not sure if ufw would need to have port 1514 ALLOWED, but your config looks good... are you sure IPTABLES isnt filtering too? – Sirch Apr 29 '19 at 15:50

0 Answers0