F5 load balancing to Log Server

[rferebee]

Hello,

I've read a couple forum posts related to load balancing vs round robin DNS to Log Server:

https://support.nagios.com/forum/viewtopic.php?t=32777

https://support.nagios.com/forum/viewto ... 38&t=33005

They are relatively old now and I was wondering if there are any new suggestions/recommendations for being able to use F5 load balancers while maintaining the source IP of the logs? A colleague suggested that an iRule on the F5 might be a solution, but was unsure if that was possible with Log Server.

All of our network devices route their logs through our F5s and since we started doing that everything appears to be coming from a single host address and our number of unique hosts has dropped off considerably (for obvious reasons).

[cdienger]

There are a couple options the way I see it - either the load balancer must be configured to forward the logs without changing the client IP(possible through an iRule?) or _if_ the logs contain the original client IP then it would be possible to extract it using logstash filters.

[rferebee]

This can be locked. Thank you.

[cdienger]

Locking.