Security Compliance

Syslogs Node in SEM using wrong IP

The way the SEM receives syslogs may cause the expected IP address to be different than the IP address used in SEM.

First published date

10/18/2018 7:41 PM

Last published date

10/18/2018 7:41 PM

Overview

The way Security Event Manager (formerly Log & Event Manager) receives syslogs may cause the expected IP address to be different than the IP address used in SEM.

Product section

Security Event Manager

Resolution

SEM's syslog collector is set to use the UDP source address of incoming syslogs rather than the IP address or hostname in the syslog message. This normally does not pose a problem except when relaying syslog messages are using a node with multiple IP addresses. If possible, IP spoofing will need to be used to correct the node IP.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.