Forum Discussion
F5 changing syslog source IPs to Float IP
I am experiencing an issue where the source IP of syslog messages passed through the F5 are being changed to the Float IP. Multiple servers on their own vlans are load balanced on the F5. Those servers send their syslog messages to a VIP for Arcsight that is load balanced off the same F5. Syslog messages from the servers are showing up with the source IP changed to the Float IP of the F5. I am not running SNAT on the Arcsight VS but I do have AutoMap enabled. Any ideas why this may be happening?
1 Reply
- fcocquyt_104704
Nimbostratus
Hi,
I had the same issue when I was adding syslog servers recently on F5. The syslog traffic towards the new syslog servers was sent with the float IP as source while the existing syslog traffic was leaving with the management IP as source.
I resolved this by performing "kill -1 PID_syslogd " from bash shell. This will send syslogd a SIGHUP and cause it to re-read the config.
(you find the PID of syslogd via command "ps -e | grep syslogd" )
Hope this helps.
Kind regards,
Frederik