> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of [email protected] > Sent: Friday, July 09, 2010 11:43 PM > To: rsyslog-users > Subject: [rsyslog] spoofing module configuration > > in reading the spoofing module configuration it strikes me that the > defaults can be significantly improved. > > the common case for needing to so spoofing is that you are spoofing the > original source IP address > > so the current configuration equivalent commands > > $template spoofaddr, "%fromhost-ip%" > $ActionUDPSpoofSourceNameTemplate spoofaddr > > could be made the default (or call it RSYSLOG_spoofaddr to keep from > polluting the namespace) and the result would be far simpler for people > to > configure, becomging simply
That's a good idea, and as so far it needs to be specified, we simply can not break existing configs. I'll see to add it ASAP (but I am on the road tomorrow and am now preparing for it). > > $modload omudpspoof > $ActionUDPSpoofTargetHost server.example.com > *.* :omudpspoof: > > it could be simplified even further if there was some way to specify > the > destination on the action line (like the @ and @@ functions do today, > could we use @S@ to indicate spoofing?) Actually, I would not like to do that, because that would merge the functionality into omfwd. Acutally, having tcp and udp in the same module is legacy and cause quite some problems in the past. I am short of splitting these two (it would also have been very useful if we were gone for a new config format in the near term). I think it is not much more burden and clearer to read if we retain a separate module type. But I am open to discussion, I could use @S@ as an alternative module designator, that would work with the current config system, but probably not extend into a new one (whatever we will end up with). > changing the defaults should have no problems with backwards > compatibility, full ack > adding/changing how the desitnation is specified could > break backward compatibility, but this is a very new piece of > functionality and the simplification may be worth it (what versions > have > this available?) 5.1.3 and above Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
