Dear Forum Members,

I have edit syslog.conf file and add there IP of QRadar event Collector for Event collection. I have different machines of linux and I have done this successfully and recieved logs in QRadar. But My requirement is that I want,syslog send logs to QRadar with the linux IP not the hostname (as an identifier) currently hostname is the identifier of linux machine. because hostname is same of all my linux machines. and I can't understand which machine is send me the logs. so is want syslog send logs to QRadar with th IP.


Your Quick Response would help me to complete my task.

Thank You!

Regards,
Zabeeh.Abid

Noted. For next time I will post at once

This is a volunteer forum...asking for/expecting a 'quick response' is fairly rude. We volunteer our time here.

That said, you don't say what version/distro of Linux you're using, or if you're using the stock syslog, or syslog-ng to do this. If it's syslog-ng, your first stop (since you needed a 'quick response') should have been the documentation. Pay particular attention to the keep_hostname and use_dns directives for syslog-ng.

Dear Friend,

Quick response mean not much Quickly. I can understand your opinion on this my friend.
as I am not much expert in linux but IBM Qradar. My customer have RHEL-6 where rsyslog is running. I configure rsyslog.conf as follows.
*.*@QRadar_IP

and I receive all logs in QRadar with hostname of linux machine. I want rsyslog send logs with the linux machine IP's. that is much understandable.

Thank You Dear for your Initial response.

The real question is why are all your hostnames the same?

On the QRADAR server, are there /etc/hosts entries for these remote syslog client hosts?

Does QRADAR have any dns-related options in its management interface?

Dear Habitual,

As for your first question, Customer said that there is no requirement for hostname different. I know that is very silly answer but you know we can't argument.

no in QRadar there is no DNS related option available where I can find subjected information. But someone said that we can add command in rsyslog to set that logs send with Linux machine IP.

Yes, it's hard to argue with a customer.

You missed one of my questions.

"On the QRADAR server, are there /etc/hosts entries for these remote syslog client hosts?"

Sorry, it did read QNAP, but I edited...

Do you have access to these remote syslog clients?

Hope this article could help you http://www.rsyslog.com/doc/v8-stable...age-properties the message property fromhost-ip could be your solution.
Cheers!

Thanks Seneka77, I couldn't find my template or remember the property.