Question: How to filter-out syslog messages that are not received by a specific NIC?
Tags:
#syslog #filter
#1
giorgiobuffa
Hello!
I'd like to log syslog messages received via broadcast on UPD:514. In the logger PC there are multiple NICs, but I'm interested only to syslog messages received from these local interfaces: `10.200.255.254` and `127.0.0.1`. I've tried with the configuration posted below, but it doesn't always work (especially at system boot) because of the following error by the NXLog Windows Service.
```
ERROR failed to start im_udp; couldn't bind udp socket to 10.200.255.254:514; The requested address is not valid in its context.
```
This is my actual configuration
```
...
define LOGS_FILE ...
...
Module xm_syslog
Module xm_exec
Module im_udp
Host 10.200.255.254
Port 514
Exec parse_syslog();
Module im_udp
Host 127.0.0.1
Port 514
Exec parse_syslog();
Module om_file
CreateDir TRUE
Sync TRUE
File '%LOGS_FILE%'
Path udp_lan, udp_host => file_syslog
```
The NIC has a static IP address, but I'm not sure it is already up when the nxlog service is executed at system boot by Windows.
How can I perform this sort of filtering without using the firewall? I know I can listen to anything and `drop()` received messages with an `Exec` statement, but I don't know which variable to use (e.g. like `$MessageSourceAddress`) to specify the interface the message was received by. I was thinking to something like that:
```
Module im_udp
Host 0.0.0.0 #