We have a Central Syslog server that we use to collect all logs from our hosts and recently got a SIEM that we also want to collect the logs.
We would like the Central Syslog server to duplicate the logs to the SIEM without changing the source IP/Source Mac. Not redirect as we would then not have the log in the Syslog server. So the end result would be that we send logs to the Central Syslog server and we would have a log in our Central Syslog server and in the SIEM from the IP of the asset that sent it to the Central syslog server.
The reasons we want to do this is.
- Some devices will only allow us to forward logs to a single syslog device
- Having to configure all devices to end logs to both is time consuming.
- If we forward any logs from the Central Syslog server using rsyslog depending on the log the source will show as the Central Syslog server which is a nightmare for correlation on the SIEM. Some logs do not contain the origin so for those logs the SIEM assume the device that forwarded the logs is the source.
I was trying to do this with iptables but can only redirect the logs instead of sending a duplicate log.
Can this be done with IP tables or any other application. I am open to any recommendations.