Syslog from source <unknown>

[victor]

It could be. Can you provide full syslog packet dump (with original text)? Probably I can tweak syslog parser so it will understand Zyxel variant correctly (we already done that for Cisco for example).

Best regards,
Victor

[user54119]

Hi Victor

That behaviour seems to be new. I didn't had this on older ZyXEL devices. I have attached a tcpdump.

Thanks
Dani

---

syslog-dump.cap

[victor]

Hi,

this message format dows not conform neither to BSD syslog format (RFC 3164) nor RFC 5424. The main problem is that 2014 as host name is a valid IP address (it's not widely known nor used, but it is valid to write IP addresses not only as n.n.n.n, but also as n, n.n, and n.n.n) so it resolves to 0.0.7.222, which of course is not found. I change node binding logic so that if server cannot find node by hostname/IP address provided in syslog message itself it still try source IP address of the message. This should solve your problem.

Best regards,
Victor

[user54119]

Hi Victor

Thanks a lot for your help. That would be very good for me. But I will report this to ZyXEL as well. But I don't know with success or not
Should I stop the logs from this device for the moment. Can you integrate this change in V1.2.15?

Dani

[user54119]

Victor

Can you realize this change in V1.2.15?

[victor]

Hi,

change already done, so it will be part of 1.2.15 release.

Best regards,
Victor

[user54119]

I just tested in V1.2.15, works perfect, thank you.

[user54119]

New problem with this feature:

Here the situation:
NetXMS -- GW1.DOMAIN1.XX -- VPN -- GW1.DOMAIN2.XX

Both 'GW1' send syslog to NetXMS server. GW1.DOMAIN1.XX ist the ZyXEL device which sends the syslog messages with wrong 'host'-field (where the new feature in V1.2.15 matches by source IP address). GW1.DOMAIN2.XX is newly connected. This Device sends correctly 'gw1' in 'host'-filed. Now the NetXMS server shows GW1.DOMAIN1.XX as source!! So we have all syslog messages from both nodes on 1 node. Big ghetto.

By the way I opened a support case at ZyXEL for the wrong 'host'-field with no success yet

Edit:
I have two other devices from the same type as GW1.DOMAIN2.XX: FW1.DOMAIN3.XX and FW1.DOMAIN4.XX. Here the syslog message source in NetXMS is correct. Thirst I thought the same host-name (but different domain) is the problem. But this is refute with this second test.

[victor]

Maybe idea to match messages based on hostname field was initially wrong and we should just revert to matching by source IP (or at least give IP based matching higher priority)?

Best regards,
Victor

[user54119]

Thanks for your reply.
For me matching by source IP would be the most logical. But I don't know if there could be a problem with nodes with multiple IP addresses or in other cases I don't know. But when the 'host'-field has priority now, why is there no problem in my second case (see 'edit' in my posting)? There are two nodes with the same host name (but different domain of course).
How fast would a solution be possible?

[user54119]

Hi Victor

Sorry for my impatience. But would it be possible to fix/change this before V1.2.17?

thanks
Dani

[victor]

Hi,

I think yes, it should be very simple change.

Best regards,
Victor

[user54119]

Very good. It would be very helpful and I can test for you. Thanks

[user54119]

Any chance for a fix before V1.2.17? Maybe a fixed souce file.

[victor]

Hi,

please try to seplace existing syslogd.cpp with attached one. It should look for node by source IP first.

Best regards,
Victor

---

syslogd.cpp

[user54119]

Hi Victor

I just made my tests, works absolutely like expected. Thanks a lot, that helps us very much.

Thanks
Dani