Rsyslog configuration for changing source interface

configurationrsyslog

I'm working on rsyslog.conf upon CentOS 6.2.

Is there any configuration in rsyslog.conf to change the source interface (eg – eth0, eth1), so that the messages being sent to syslog server contains the same source IP address (which is obtained from the "source interface" mentioned)?

Best Answer

For outgoing connections the source interface is usually determined according to your routing tables. If you do ip route show you should get some output similar to this:

default via 10.70.0.1 dev wlan0  metric 2003 
10.20.0.0/16 dev ppp0  scope link 
10.60.2.10 dev ppp0  proto kernel  scope link  src 10.60.2.15 
10.70.0.0/16 dev wlan0  proto kernel  scope link  src 10.70.0.100  metric 2003 
127.0.0.0/8 via 127.0.0.1 dev lo 
222.44.42.55 via 10.70.0.1 dev wlan0  src 10.70.0.100

In this snippet you see a list of destination networks on the left side, and after the dev keyword you see which outgoing interface is going to be used for outgoing packets to this destination.

If you want to modify this behaviour you can change your routes by using the ip utility, for this you can check man ip-route. Another way which is more powerful but also more complicated would be to create specific routing rules, you can see more about that in man ip-rule.

Related Topic