1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Syslog source address

Discussion in 'Tomato Firmware' started by maleadt, Jul 31, 2011.

  1. maleadt

    maleadt Networkin' Nut Member

    Hi all,

    I've been trying out the Tomato firmware (currently the Victek release), and I'm experiencing a (admittedly minor) issue with syslog logging: with the router configured to log "remotely" to a server within my own network, the source address is always wrong.

    More specifically, Tomato has the "log internally" and "log to remote server" specified, pointing to a syslog server on the internal subnet.This results in Busybox's syslogd to be started like this: "syslogd -R 192.168.0.6:514 -L -s 50". No problems here.

    At the syslog master server however, syslog messages weren't prefixed with the correct hostnames (I was getting a hostname reversibly resolved from my WAN IP address instead of the correct internal hostnames). Looking into this, it seemed that the source IP of all syslog packets contained my router's WAN address instead of the local IP address:
    Due to the syslog packets not containing the correct source IP, my syslog server isn't able to display proper hostnames in front of syslog messages, cluttering my logs.

    Does anybody know whether this is an error, or did I miss something? When ping'ing my syslog server (or, for that matter, sending any other data), the source addresses always seem to be correct (e.g. 192.168.0.1 instead of 178.116.x.y), so it seems that basic routing is working properly.

    Thanks
     

Share This Page