Two HOP SYSLOG forwarding

[Sathya Sastry]

Hello,

We have a situation where we need to forward syslog from routers with double hop.

example:
Router1 will forward it syslog to Server1 and the syslog from Server1 is forwarded to Server2.

Now the question is how to maintain the source of the syslog messages?

The syslog in the Server2 is showing source address as Server1, which is correct as it is being forwarded from Server1. But the log messages are generated from Router1.

Is this possible?

The Router1 is a Cisco Router
Server1 is a SUN system
================Syslog.conf at Server1=======
*.err;kern.notice;auth.notice /dev/sysmsg
*.err;kern.debug;daemon.notice;mail.crit /var/adm/messages
local1.info /usr/app/netx/Log/log_dbsync
local0.info /usr/app/netx/Log/log_dbsync

*.alert;kern.err;daemon.err operator
*.alert root

*.emerg *

# if a non-loghost machine chooses to have authentication messages
# sent to the loghost machine, un-comment out the following line:
#auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost)

mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost)

#
# non-loghost machines will use the following lines to cause "user"
# log messages to be logged locally.
#
ifdef(`LOGHOST', ,
user.err /dev/sysmsg
user.err /var/adm/messages
user.alert `root, operator'
user.emerg *
)

# Loghost configuration: receive all debug messages from devices
*.debug /log/masterlog

# forward to loghosts
*.alert @sqdevov1
*.alert @sqprdov1
=============================================
Server2 is a HPUX system.
================Syslog.conf at Server1=======
cat /etc/syslog.conf
# @(#)B.11.11_LR
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#

mail.debug /var/adm/syslog/mail.log

#
#*.info;mail.none /var/adm/syslog/syslog.log
#*.alert /dev/console
#*.alert root
#*.emerg *
#
#

*.info;mail.none;local0.none;local1.none;local2.none;local3.none;local4.none;local5.none;local6.none;local7.none /var/adm/syslog/syslog.log

*.alert /dev/console
*.alert root
*.emerg *

user.debug /var/opt/OV/share/log/syslog.user.log
local0.debug /var/opt/OV/share/log/syslog.local0.log
local1.debug /var/opt/OV/share/log/syslog.local1.log
local2.debug /var/opt/OV/share/log/syslog.local2.log
local3.debug /var/opt/OV/share/log/syslog.local3.log
local4.debug /var/opt/OV/share/log/syslog.local4.log
local5.debug /var/opt/OV/share/log/syslog.local5.log
local6.debug /var/opt/OV/share/log/syslog.local6.log
local7.debug /var/opt/OV/share/log/syslog.local7.log
*.debug /var/opt/OV/share/log/syslog.m

=============================================

Syslog messages at the Server2 are as follows:

=============================================
sqprdov1 >tail -2 /var/opt/OV/share/log/syslog.local7.log
Oct 3 15:07:18 snoquagw10 11877: *Oct 3 17:01:58.160 CDT: %HSRP-4-DIFFVIP1: FastEthernet0/0.8 Grp 8 active routers virtual IP address 5.128.129.129 is different to the locally configured address 5.129.129.129
Oct 3 15:07:20 snoquagw10 11710: Oct 3 18:28:34.542 EDT: %IP-4-DUPADDR: Duplicate address 5.132.16.1 on FastEthernet0/0.12, sourced by 0008.0050.f47b
sqprdov1 >tail -2 /var/opt/OV/share/log/syslog.m
Oct 3 15:07:18 snoquagw10 11877: *Oct 3 17:01:58.160 CDT: %HSRP-4-DIFFVIP1: FastEthernet0/0.8 Grp 8 active routers virtual IP address 5.128.129.129 is different to the locally configured address 5.129.129.129
Oct 3 15:07:20 snoquagw10 11710: Oct 3 18:28:34.542 EDT: %IP-4-DUPADDR: Duplicate address 5.132.16.1 on FastEthernet0/0.12, sourced by 0008.0050.f47b
=============================================


Any pointers/help is appreciated.

Sathya.

[Lee Harris_5]

Hi,

Not sure if this will help, but you might be able to setup some kind of dirty hack using a programme called "netcat" (have a look at hpux.connect.org.uk). This programme can listen for data on a network port and simply cat it out to another file, or host or port etc etc.

HTH