rewrite source ip address

[munthajeeb]

I have a requirement where the received syslog's source IP address needs to be changed.
This needs to be done not for all the syslogs but only for a selected few. When i searched
I found syslog-ng version 3.0 has a rewrite feature which rewrites parts of the syslog
before we can forward it. But this is only rewriting the source ip in the UDP layer and
does not change in the IP layer. The configuration i used in conf file is :

rewrite replace_source_ip{
        subst("10.168.128.235", "10.68.128.229", value("MESSAGE"));
}

Is there any way I can change the source IP value in IP layer ?

[mutex]

Let me say what I think you're trying to do, and you can correct me if I'm wrong:

You want to send out syslog messages from a syslog-ng server to some other system.  You want some of the messages to have a source address (at the network layer) that is not the syslog-ng server's address.  Presumably because there is some intelligence in the receiving system around what host the syslog message is from.

Is that accurate?

[munthajeeb]

Actually, devices are sending syslogs to syslog-ng server which is forwarding them
to another application. I just want to change the source IP of syslogs comming from
some devices.

Yes want to change them in the network layer.

[mutex]

You'll need to reconfigure/recompile syslog-ng with the "--enable-spoof-source" argument given to "configure".

There should be a file with the distribution called "README.spoof" with more info.  I've never played with it, so I can't be a lot of help beyond that.

[munthajeeb]

I did a snoop in the destination application and found the network layer shows the ip
address of the syslog server.  So I dont want to change that.
 
But the syslog layer shows an ipaddress of the device (50.50.50.50 shown below).
Which is what I want to change. Sorry for the confusion.

snoop output
------
..
SYSLOG:  ----- SYSLOG:   -----
SYSLOG:  
SYSLOG:  Priority: (BAD.FMT)
SYSLOG:  "Original Address=50.50.50.50 user.notice: SyslogGen: Origi"
SYSLOG:  
--------------------------