Tagging/modifying syslog-ng message from different source using same IP

Q & ACategory: QuestionsTagging/modifying syslog-ng message from different source using same IP
Rafael asked 4 months ago

Hello All:
Greetings. First of all, thanks for take your time and read this question; apologies by my poor English. I’m really n00b about syslog-ng, but I did the job and reading syslog-ng-ose-admin-guide.pdf and I still can’t solved my problem.
This is my scenario: I work in a company which supply cloud security services to customers. An appliance with virtual machines (VMs) is installed in customer’s premise as part of our services, as describe below:

  • VMs offering security services with syslog-ng client configuration.
  • Splunk Forwarder (UF) VM with syslog-ng server configuration.

In our cloud premise, we running Splunk Enterprise for collect/correlate/analyze logs.
In this appliance, all VMs are configured using a static no-routable IP (172.16.X.X) and VMs with syslog-ng clients forwards selected logs to syslog-ng server. UF relays this collected logs to SE. This configuration is holded in ALL customers.
This appliance is configured in such way each VM had . So, by example; if VM1 have IP 172.16.1.1, VM2 172.16.1.2, in the customer’s premise cust1, cust2 and cust3 VM1 have the same IP 172.16.1.1 and so on.
So, this is our problem: when SE receive logs from VMs via UF, we can’t identify who is data owner’s, because VMs had same IP in all customers so when we inspect data from Splunk asking for 172.16.1.1, we don’t know if results comes from cust1, cust2 or cust3. In fact, the results is a mess of cust1, cust2 and cust3 logs, we believe.
Reading the mentioned PDF, I found we can modify syslog-ng message with tagging. So, by identify log’s customers properly, we think we can modify message adding an unique customer ID, so customer’s logs can be consulting and correlated in SE without confusing.
But I don’t know which commands/option/capabilities in syslog-ng I should use in order to tagging customer’s logs as described before.
So, this is my questions: is tagging a real solution to my problem? If it is, how I should use tagging in syslog-ng configuration? Can you provide me some examples? Are there other ways to solve my problem?
Please, I really N00b about syslog-ng and any help will be appreciated, even if you consider basic your support, guide, advice or answer. I really open to syslog-ng 101 answers.
Please, let me note if you need further explanation about my problem, I hope I had described enough.
Thank you very much and best regards,
 
Rafael