# Graylog + Nginx Load Balanced Syslog - Source is the Load Balancer

**URL:** <https://community.graylog.org/t/graylog-nginx-load-balanced-syslog-source-is-the-load-balancer/930>\
**Category:** Graylog Central (peer support)\
**Created:** [April 26, 2017, 1:48am UTC](https://community.graylog.org/t/graylog-nginx-load-balanced-syslog-source-is-the-load-balancer/930 "2017-04-26T01:48:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rayterrill](https://avatars.discourse-cdn.com/v4/letter/r/65b543/32.png) [@rayterrill](https://community.graylog.org/u/rayterrill)\
**Post date:** [April 26, 2017, 1:48am UTC](https://community.graylog.org/t/graylog-nginx-load-balanced-syslog-source-is-the-load-balancer/930/1 "2017-04-26T01:48:44Z")

</div>

We’ve got 3 graylog servers, and I added an Nginx load balancer in front of them today. We’re load balancing GELF, syslog TCP and UDP, and the web interface itself.

One thing I noticed on the UDP syslog input is that the source is coming into Graylog as the load balancer’s DNS name - not the source of the actual server sending the logs. This isn’t the end of the world, but it also isn’t ideal.

Anything slick we can do with either Nginx or Graylog to keep the source as the original source?

Here’s the relevant piece of my nginx.conf file:

```auto
    upstream gludpsyslog {
         server popglweb1.pop.portptld.com:1514;
         server popglweb2.pop.portptld.com:1514;
         server popglweb3.pop.portptld.com:1514;
    }

    server {
         listen 1514 udp;
         listen 514 udp;
         proxy_pass gludpsyslog;
         proxy_responses 0;
    }

```

And here is the full message:

```auto
<167>2017-04-26T01:45:16.820Z vmhost10.pop.portptld.com Hostd: verbose hostd[E081B70] [Originator@6876 sub=SoapAdapter.HTTPService] HTTP Response: Auto-completing at 129/129 bytes

```

Screenshot of the message in graylog:.

 ![](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/1X/32f275ce77134cc63cbdd25b60ee21341df594fd.PNG)

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [April 26, 2017, 8:21am UTC](https://community.graylog.org/t/graylog-nginx-load-balanced-syslog-source-is-the-load-balancer/930/2 "2017-04-26T08:21:55Z")

</div>

Which version of Graylog are you using? Graylog 2.2.3 should correctly parse the syslog message you’ve provided.

Also, what kind of client does create these syslog messages?

Output of a quick test case using Graylog’s syslog parser:

```auto
fields = {HashMap@3161} size = 7
 0 = {HashMap$Node@3166} "level" -> "7"
 1 = {HashMap$Node@3167} "full_message" -> "<167>2017-04-26T01:45:16.820Z vmhost10.pop.portptld.com Hostd: verbose hostd[E081B70] [Originator@6876 sub=SoapAdapter.HTTPService] HTTP Response: Auto-completing at 129/129 bytes"
 2 = {HashMap$Node@3168} "_id" -> "117f97c0-2a59-11e7-80da-56ae9a9f0542"
 3 = {HashMap$Node@3169} "source" -> "vmhost10.pop.portptld.com"
 4 = {HashMap$Node@3170} "message" -> "vmhost10.pop.portptld.com Hostd: verbose hostd[E081B70] [Originator@6876 sub=SoapAdapter.HTTPService] HTTP Response: Auto-completing at 129/129 bytes"
 5 = {HashMap$Node@3171} "facility" -> "local4"
 6 = {HashMap$Node@3172} "timestamp" -> "2017-04-26T01:45:16.820+00:00"

```

---

<div class="post-metadata">

**Author:** ![rayterrill](https://avatars.discourse-cdn.com/v4/letter/r/65b543/32.png) [@rayterrill](https://community.graylog.org/u/rayterrill)\
**Post date:** [April 26, 2017, 1:55pm UTC](https://community.graylog.org/t/graylog-nginx-load-balanced-syslog-source-is-the-load-balancer/930/3 "2017-04-26T13:55:11Z")

</div>

Graylog 2.2.3+7adc951.

This is coming from a VMWare VMHost.