Syslog from source <unknown>

[user54119]

Victor

Can you realize this change in V1.2.15?

[victor]

Hi,

change already done, so it will be part of 1.2.15 release.

Best regards,
Victor

[user54119]

I just tested in V1.2.15, works perfect, thank you.

[user54119]

New problem with this feature:

Here the situation:
NetXMS -- GW1.DOMAIN1.XX -- VPN -- GW1.DOMAIN2.XX

Both 'GW1' send syslog to NetXMS server. GW1.DOMAIN1.XX ist the ZyXEL device which sends the syslog messages with wrong 'host'-field (where the new feature in V1.2.15 matches by source IP address). GW1.DOMAIN2.XX is newly connected. This Device sends correctly 'gw1' in 'host'-filed. Now the NetXMS server shows GW1.DOMAIN1.XX as source!! So we have all syslog messages from both nodes on 1 node. Big ghetto.

By the way I opened a support case at ZyXEL for the wrong 'host'-field with no success yet

Edit:
I have two other devices from the same type as GW1.DOMAIN2.XX: FW1.DOMAIN3.XX and FW1.DOMAIN4.XX. Here the syslog message source in NetXMS is correct. Thirst I thought the same host-name (but different domain) is the problem. But this is refute with this second test.

[victor]

Maybe idea to match messages based on hostname field was initially wrong and we should just revert to matching by source IP (or at least give IP based matching higher priority)?

Best regards,
Victor

[user54119]

Thanks for your reply.
For me matching by source IP would be the most logical. But I don't know if there could be a problem with nodes with multiple IP addresses or in other cases I don't know. But when the 'host'-field has priority now, why is there no problem in my second case (see 'edit' in my posting)? There are two nodes with the same host name (but different domain of course).
How fast would a solution be possible?

[user54119]

Hi Victor

Sorry for my impatience. But would it be possible to fix/change this before V1.2.17?

thanks
Dani

[victor]

Hi,

I think yes, it should be very simple change.

Best regards,
Victor

[user54119]

Very good. It would be very helpful and I can test for you. Thanks

[user54119]

Any chance for a fix before V1.2.17? Maybe a fixed souce file.

[victor]

Hi,

please try to seplace existing syslogd.cpp with attached one. It should look for node by source IP first.

Best regards,
Victor

---

syslogd.cpp

[user54119]

Hi Victor

I just made my tests, works absolutely like expected. Thanks a lot, that helps us very much.

Thanks
Dani