Windows/Linux IP in Log Server

[tryingtobeIT]

Hi,

I am in an environment where my IP's cannot be set to static. My Windows and Linux IP's have changed. How do I edit the old IP's to the new IP's in Log Server?

[sgardil]

Hi,

I am in an environment where my IP's cannot be set to static. My Windows and Linux IP's have changed. How do I edit the old IP's to the new IP's in Log Server?

Hey,

What exactly are you trying to change for the new ip's? Are you trying to change what ip logs are being sent to with something like nxlog? If so you need to update your nxlog.conf and update the output section to have the correct ip.

[gwesterman]

Hi @tryingtobeIT,

You could also try making a filter to match the IPs (either convert the old IP to the new or vise versa). Filters are applied to logs before they are sent to elasticsearch, so you could swap the IPs as you wish as long as you know the addresses. This doesn't permanently solve the issue if your IPs continue to change unless:
1. Make the filter particularly general or
2. You make the filter match something that is consistent and unique to the server so it can be identified regardless of its IP.

Log server can't know what IP your servers will change to so a comprehensive solution involves static IPs, a filter in LS that matches any IP under a certain network (but that will join every log from any source in that network), or a filter that matches something unique to the server that stays the same when the IP changes.

Let us know what you try and how it turns out. Thank you!

[jmichaelson]

There's no quick way to update the IP addresses of a given log entry in NLS. Log entries are a record of what came from where at any given time, and aren't intended to be updated once set. If you use the Nagios Log Server backend API and Elasticsearch queries to update the ip address of log entries in bulk, using the appropriate Elasticsearch query (Nagios Log Server uses Elasticsearch 1.7.6 if you need to access the documentation on how to do that update). This post may be helpful in doing that:

https://stackoverflow.com/questions/375 ... arch-1-7-5

I don't really recommend this, however, as it can be very time consuming depending on the number of logs (and ip addresses) that need updating. You'll also have to be careful that you work around IP address collisions. i.e., host a was 192.168.1.1 yesterday and 192.168.1.2 today, host b was 192.168.1.2 yesterday and 192.168.1.3 today, and host c 1as 192.168.1.3 yesterday and 192.168.1.1 today, that update would be virtually impossible without a lot of trickery and remapping ip addresses multiple times for a given system to avoid two hosts ending up with the same IP address in the database.

You can attempt to mitigate this in the future by configuring your log sources to send a constant ip address even if it doesn't match the system.

Your absolute best bet though is to use DHCP to give each system a permanent ip address via a reservation.

For environments using ISC's KEA DHCP server on Linux the reference for that is https://kb.isc.org/docs/what-are-host-r ... o-use-them, for Windows DHCP servers, there's good documentation here https://learn.microsoft.com/en-us/answe ... p-settings