rsyslog IP Spoofing

Latest response

I have a new RHEL rsyslog central server I am using to replace a Windows Kiwi central server. Kiwi can spoof the IP of the incoming messages so that when it sends them out to our SIEM that appear to come from the original host. Both Kiwi and syslog-ng have this ability. I cannot find a way to do this with rsyslog and need some help. Can anyone assist me? I found information on omudpdpoof, but it appears this is not support on RHEL 6. Any suggestions would be appreciated. I am willing to use UDP or TCP.

Responses