For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Peter_Z's avatar
Peter_Z
Icon for Cirrus rankCirrus
Sep 25, 2018

Rewrite hostname in syslog packets hitting syslog VS

Hello,   We have a Syslog Virtual server taking syslog messages from various devices on the network, then forwarding to real syslog collectors. We have a request to rewrite hostname (originating d...
application delivery
iRules
LTM
youssef1's avatar
youssef1
Icon for Cumulonimbus rankCumulonimbus
Sep 25, 2018

Hi Peter,

 

As you know we use the syslog to transmit the logs because it uses UDP. UDP does not provide acknowledgments (fast and consumes very little resource). Additionally, at the application layer, syslog servers do not send acknowledgments back to the sender for receipt of syslog messages.

 

it may be possible to modify the hostname, but it remains to be verified:

 

https://devcentral.f5.com/questions/add-a-new-data-on-the-udp-payload

 

however, you may slow down the treatment. and since it's UDP, if some package is not processed for X reason, it will not be returned because of UDP and not TCP...

 

regards