This is a two part problem relating to source IP addresses used by nxlog:

1. We have several systems that use 192.168.x.x addresses as their source - not sure what this is about, but I'm thinking it may be related to the nxlog service starting before the Windows network services are completely up?

2. We have several systems that have multiple IP addresses (interfaces) and we would like to force nxlog to report from one IP address. Is there a way to do this?

Thanks for your help.

AskedApril 3, 2018 - 3:34pm

Answer (1)

This is all handled on the networking level by the OS kernel. The IP address that the application (NXLog) sends TCP packets from is controlled by networking/routing and there is nothing you can do to change this in the application.

It is only possible to change the IP address for UDP packets via the om_udpspoof module available in the NXLog EE.