Topic
  • 7 replies
  • Latest Post - ‏2012-11-27T19:52:26Z by SystemAdmin
kepa
kepa
16 Posts

Pinned topic syslog and local identifier

‏2012-02-08T13:33:19Z |
Hello,

I have an odd behaviour of one of our XI50 boxes

I use the following Log target

Target Type : syslog
Local Identifier : myidentifier
Remote Host : IP@ syslog daemon
Remote Port : 514
Local IP Address : local IP@
syslog Facility : local7
Rate Limit : 100
Feedback Detection : off
Identical Event Detection : off

Messages received by the syslog server always display local IP@, not "myidentifier". I can change the IP@ by another local IP@ and it reflects in the messages.

Another XI50 box ( production ) works fine, i.e it gives "myidentifier"

Both are running 3.8.2.6

Any ideas ?

Thank you
Kép

Help says

Local Identifier
Specify a descriptive string that identifies the log target to remote recipients. For syslog destinations, do not include spaces.
Updated on 2012-11-27T19:52:26Z at 2012-11-27T19:52:26Z by SystemAdmin
  • nmmanisk
    nmmanisk
    16 Posts

    Re: syslog and local identifier

    ‏2012-02-08T16:14:51Z  
    Hi kepa,

    Whether or not to use the local identifier is up to the server. You should check to see that your development/test environment's syslog server is configured to honor the local-identifier/hostname of the syslog client (DataPower). By default, some server implementations may not honor this field. Comparing the server configuration to your production server, which works, may be helpful.

    Regards,
    Nicholas Maniskas
  • Ramsyee
    Ramsyee
    129 Posts

    Re: syslog and local identifier

    ‏2012-02-09T00:47:39Z  
    Hi
    1)Please delete the log target if possible and create a new one.
    2)I assume that you are not using the same identifier, if you are using same
    i will suggest you to create a new identifier(which should be differnt Dp-sytbox .

    Thanks
  • Ramsyee
    Ramsyee
    129 Posts

    Re: syslog and local identifier

    ‏2012-02-09T00:49:31Z  
    • Ramsyee
    • ‏2012-02-09T00:47:39Z
    Hi
    1)Please delete the log target if possible and create a new one.
    2)I assume that you are not using the same identifier, if you are using same
    i will suggest you to create a new identifier(which should be differnt Dp-sytbox .

    Thanks
    And also do not include spaces or underscores
    use some thing like

    Logtarget-Datapower-prodbox.
  • SystemAdmin
    SystemAdmin
    6772 Posts

    Re: syslog and local identifier

    ‏2012-11-27T00:47:29Z  
    Regarding the Local IP or Alias of the appliance in syslog, does this mean the management IP/alias or another NIC with only application traffic, being the traffic I am concerned with?

    Thanks,
    Kirby
  • Trey
    Trey
    225 Posts

    Re: syslog and local identifier

    ‏2012-11-27T01:31:48Z  
    Regarding the Local IP or Alias of the appliance in syslog, does this mean the management IP/alias or another NIC with only application traffic, being the traffic I am concerned with?

    Thanks,
    Kirby
    Hey Kirby,
    Yes similar to the MQ FSH use of a local ip, the source ip the syslog events are issued from. Just like all tcp/ip connections you have the source ip and destination ip. This field allows you to define the source ip.

    As always .. test to make sure all behaves as expected and if you run into problems or misbehavior open a pmr and ill be glad to dig in and help.
  • SystemAdmin
    SystemAdmin
    6772 Posts

    Re: syslog and local identifier

    ‏2012-11-27T14:27:51Z  
    • Ramsyee
    • ‏2012-02-09T00:47:39Z
    Hi
    1)Please delete the log target if possible and create a new one.
    2)I assume that you are not using the same identifier, if you are using same
    i will suggest you to create a new identifier(which should be differnt Dp-sytbox .

    Thanks
    I believe Ramsyee is pointing if and only if one is using the same syslog server. We can definitely have the same local identifier if utilize the different syslog servers...

    As Nicholas suggested we'd need to check the configurations on the syslog server for this

    Good luck!

    Regards,
    Salla
  • SystemAdmin
    SystemAdmin
    6772 Posts

    Re: syslog and local identifier

    ‏2012-11-27T19:52:26Z  
    • Trey
    • ‏2012-11-27T01:31:48Z
    Hey Kirby,
    Yes similar to the MQ FSH use of a local ip, the source ip the syslog events are issued from. Just like all tcp/ip connections you have the source ip and destination ip. This field allows you to define the source ip.

    As always .. test to make sure all behaves as expected and if you run into problems or misbehavior open a pmr and ill be glad to dig in and help.
    Thanks Trey