Forum Discussion

Peter_Z's avatar
Peter_Z
Icon for Cirrus rankCirrus
Sep 25, 2018

Rewrite hostname in syslog packets hitting syslog VS

Hello,

 

We have a Syslog Virtual server taking syslog messages from various devices on the network, then forwarding to real syslog collectors. We have a request to rewrite hostname (originating device) in the syslog messages for certain devices. Is there a way to achieve this via iRule?

 

Thanks

 

application delivery
iRules
LTM
  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Sep 25, 2018

    Hi Peter,

     

    As you know we use the syslog to transmit the logs because it uses UDP. UDP does not provide acknowledgments (fast and consumes very little resource). Additionally, at the application layer, syslog servers do not send acknowledgments back to the sender for receipt of syslog messages.

     

    it may be possible to modify the hostname, but it remains to be verified:

     

    https://devcentral.f5.com/questions/add-a-new-data-on-the-udp-payload

     

    however, you may slow down the treatment. and since it's UDP, if some package is not processed for X reason, it will not be returned because of UDP and not TCP...

     

    regards