I'm working on rsyslog.conf upon CentOS 6.2.

Is there any configuration in rsyslog.conf to change the source interface (eg - eth0, eth1), so that the messages being sent to syslog server contains the same source IP address (which is obtained from the "source interface" mentioned)?


For outgoing connections the source interface is usually determined according to your routing tables. If you do ip route show you should get some output similar to this:

default via dev wlan0  metric 2003 dev ppp0  scope link dev ppp0  proto kernel  scope link  src dev wlan0  proto kernel  scope link  src  metric 2003 via dev lo via dev wlan0  src

In this snippet you see a list of destination networks on the left side, and after the dev keyword you see which outgoing interface is going to be used for outgoing packets to this destination.

If you want to modify this behaviour you can change your routes by using the ip utility, for this you can check man ip-route. Another way which is more powerful but also more complicated would be to create specific routing rules, you can see more about that in man ip-rule.

  • Hi, Thanks for the prompt reply.Thanks a lot:) One more small query.. I want to know if the "changing of routes" can be made specific only to "syslog packets"? Is there any configuration in rsyslog to facilitate this ?
    – Revathy
    Aug 20 '13 at 12:35
  • Since the ip utility and the routing are working only on IP level, they can only create rules based on combinations of src host and dst host. I don't think you can specify any source host inside the rsyslog configuration itself, and in most circumstances this shouldn't be necessary. So I would like to ask why you have this requirement of specifying a different source interface just for one service?
    – replay
    Aug 20 '13 at 13:08
  • My requirement is to "set all system logging (syslog) messages being sent to syslog servers to contain the same IP address, regardless of which interface the syslog message uses to exit the router". This i need to do by specifying the source interface(eth0 or eth1).
    – Revathy
    Aug 21 '13 at 3:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.