If you run a NOC or SOC, you already know the problem: syslog messages come in from hundreds of devices, and they all need to end up in more than one place — a SIEM for alerting, a long-term archive for compliance, maybe an internal log search tool for your on-call engineers. Echo Base exists to solve exactly that, and this post walks through how it actually does it.
Listening on two ports at once
Echo Base binds UDP 514 and 5514 simultaneously, so it can sit in for both a “standard” syslog receiver and devices that have been configured to use the alternate port. Every message that arrives gets parsed and handed to the rules engine before anything else happens to it.
The dashboard above is the first thing you see after deploying — live throughput, drop counts, and the health of every destination pool, updated in real time.
The rules engine
Every incoming message is evaluated against your routing rules in priority order. Rules can match on source IP, facility, severity, hostname, app name, or message content, and each rule has one of three actions:
- Route — send to a single pool and stop evaluating further rules
- Duplicate — send to a pool and keep evaluating, which is how a single message ends up fanned out to your SIEM and your archive at the same time
- Drop — discard the message entirely (useful for noisy devices you don’t want cluttering downstream systems)
Because rules are ordered, you can build fairly sophisticated fan-out logic without writing any code — put your broad “send everything to the archive” duplicate rule last, and your specific high-priority routes ahead of it.
Where messages actually go: destination pools
Destinations are grouped into pools, and each pool does independent ICMP health checking with configurable intervals and failure/success thresholds. If a destination in a pool goes unreachable, Echo Base stops sending to it and automatically routes around the outage — no manual failover, no stuck messages.
Within a healthy pool, Echo Base load-balances using either round-robin or random distribution, depending on how you’ve configured it.
The part that matters most: IP spoofing
This is the feature that makes Echo Base a true exploder rather than just a forwarder. Using raw sockets, Echo Base can relay a message while preserving the original device’s source IP address — so your downstream SIEM or archive sees the real device, not Echo Base’s own IP. That matters enormously for anything that correlates or alerts on source IP: you don’t have to teach every downstream tool that a relay is in the path.
Deploying it
Echo Base ships as a single Go binary or a Docker container — no message broker, no external database beyond local SQLite for admin auth. On bare metal or in a Proxmox LXC, it just needs the NET_RAW capability for spoofing to work; in Docker that’s --network=host --cap-add=NET_RAW.
Not sure what you’ll need?
Before you commit to a deployment size, run Endor Ops against it — our free, open-source load-testing tool built specifically to benchmark syslog and SNMP trap relays at realistic volumes. We’ll cover exactly how that works in the next post.
← All Posts