For avoiding IP aliasing across NAS locations, which approach is recommended: feed management with an ingestion label per log source?

• A. Configure feed management to pull data from each location and configure a namespace per log source.
• B. Configure feed management to pull data and configure an ingestion label per log source.
• C. Configure a Bindplane agent collecting Syslog from each location and configure a namespace per log source.
• D. Configure a Bindplane agent and an ingestion label per log source.

Answer: (C)

Avoiding IP aliasing across NAS locations relies on preserving the true source of logs rather than relying on IP addresses that can be reused in different sites. The best approach is to deploy a BindPlane agent at each NAS location to collect Syslog locally. This keeps the log provenance tied to the actual site and device, not to a central collection path that could blur identical IPs from different locations. Pairing this with a namespace configured per log source creates a strong, explicit separation within the ingestion pipeline, so logs from distinct sources remain distinct even if other fields overlap. A per-site agent ensures reliable source attribution, while the namespace provides consistent isolation across sources in the same feed. Ingestion labels can tag data, but they’re not as robust for preventing cross-location confusion as having a dedicated namespace for each log source.