Re: [rsyslog] UDP spoofing output module (omudpspoof)

David Lang Tue, 01 Oct 2013 13:48:52 -0700

On Tue, 1 Oct 2013, Rainer Gerhards wrote:

Am 01.10.2013 21:32 schrieb "Ganji, Shashirekha Yadav" <
[email protected]>:



Hi David,

I appreaciate your response.

My understanding is that this output module is used only as a patch for

broken syslog servers to catch up the source hostnames and forward them.So
Rsyslog has Out of the box capability to tag hostnames but does not support
IPV6 address.

Correct me if I'am wrong.


sorry, I somehow missed this response.

rsyslog has many ways to fix broken hostnames, udpspoof is only for cases wherethe thing receiving the logs ignores hostnames and only looks at the source IPin the packet headers.

if you are relaying using rsyslog and you have systems that are generatinginvalid hostnames, you can fix that up by creating a template for the messageyou are forwarding.


for example, RSYSLOG_TraditionalForwardFormat is (roughly)
<%pri%>%timereported% %hostname% %syslogtag%%msg%\n

you could create a new template that said

<%pri%>%timereported% %fromhost% %syslogtag%%msg%\n

and the relay server would do a reverse DNS lookup of the IP it received the logmessage from and put that name in the hostname field as it forwards it on.


or if you used fromhost-ip it would put the ip in the field.

Rsyslog supports IPv6 just about everywhere, udpspoof is the only place I knowof that isn't supported (although I expect some syslog systems will haveproblems if they see an IPv6 IP address in the hostname field)


David Lang

I have to admit I do not fully understand what you are saying.

Rsyslog fully supports ipv6, it is just that the spoofing module does not
do that. What is your use case? Why do you need spoofing?

Rainer


Thanks,
shashi
-----Original Message-----
From: [email protected] [mailto:

[email protected]] On Behalf Of David Lang

Sent: Monday, September 30, 2013 1:16 PM
To: rsyslog-users
Subject: Re: [rsyslog] UDP spoofing output module (omudpspoof)

anything's possible :-)

Rsyslog gains new capabilities by a couple of different methods

1. people write a feature and submit it. This is how the UDP spoofing

module came about, my company needed this capability, so I wrote a module
and submitted it (it's been improved since then)


2. people sponsor someone else to write a feature (Rainer and adiscon do

this sort of work all the time, contact him directly for a quote on adding
the feature if you're interested)


3. people suggest features and they go somewhere on a mile-long TODO

list, if there is enough interest from other people, Rainer or someone else
will write the feature.


unfortunantly, things are being added to the TODO list faster than they

are being implemented (not an unusual situation), so you need to make a
case that a feature is needed by a lot of people, or somehow make it
'interesting' enough for someone to want to tackle.


In the particular case of UDP spoofing, this is only needed if you are

relaying messages to a broken syslog system that ignores the hostname in
the header and only looks at the IP address in the packet. The amount of
interest in working around such broken systems tends to not be very high
(for some strange reason

;-)

I'll point out that it's very easy to have the rsyslog relay box replace

the hostname in the message with the IP address of the sending system if
the issue you are trying to deal with is trusting the hostname in the
message.


If you can deal with structured data on the receiver, you can even put

both in the message without loosing any ability to parse out the original
info.


David Lang

On Mon, 30 Sep 2013, Ganji, Shashirekha Yadav wrote:

Thanks for your response.
Is it possible to have this capability in future or any other way to

incorporate this into rsyslog?


Thanks,
shashi

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of David Lang
Sent: Monday, September 30, 2013 12:47 PM
To: rsyslog-users
Subject: Re: [rsyslog] UDP spoofing output module (omudpspoof)

this module does not talk IPv6, so it can't forge IPv6 source addresses

or send to IPv6 destination addresses.


David Lang

On Mon, 30 Sep 2013, Ganji, Shashirekha Yadav wrote:

Hello team,

I had a question on the mentioned output module.
It is mentioned that "IPv6 is currently not supported. If you need

this capability, please let us know via the rsyslog mailing list." As a
known issue.I need more clarity on this.

Does it mean this output module does not support IPV6 address for

target or overall IPV6 traffic.

Thanks,
shashi

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of

sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL:

This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of

sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL:

This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad

of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] UDP spoofing output module (omudpspoof)

Reply via email to