Collector: Preserving Host/Address of SYSLOG Origin

Follow

Matthew Watkins

• October 01, 2018 15:38

We have a Sumo Logic collector installed on a server instance running in AWS. It receives SYSLOG messages over a VPN from our Cisco switches. When these messages arrive in the Sumo Logic portal, the origin is reported as the collector. Is there any option or configuration flag/setting that will preserve the original device's IP address when passing data through in this way?

Thanks in advance...

0

• 

  James

  • October 11, 2018 09:04

  Hi Matt,

  As per our emails, we determined that the values you were looking for were captured in the _sourceHost field as expected. Thanks for asking the question on here, hopefully it'll help anyone else with the same question!

  Thanks,

  James

  0

  Comment actions Permalink

Please sign in to leave a comment.