<![CDATA[Syslog source became <unknown>]]>We recently upgraded NetXMS 1.2.17 to 2.0.3 (1.2.17 > 2.0.2 > 2.0.3) but the syslog data from existing nodes are being displayed as <unknown>. However nodes (Same model and firmware from <unknown> syslog data) added after upgrade to 2.0.3 are being identified correctly. Any ideas?

]]>https://forum.netxms.org/topic/4488/syslog-source-became-unknownRSS for NodeFri, 13 Nov 2026 14:19:19 GMTFri, 27 May 2016 09:52:55 GMT60<![CDATA[Reply to Syslog source became <unknown> on Sat, 11 Jun 2016 02:06:22 GMT]]>Hi Victor,

I deleted then re-added a node and the source can display properly but the "show index nodeaddr" still return nothing.

]]>https://forum.netxms.org/post/20116https://forum.netxms.org/post/20116Sat, 11 Jun 2016 02:06:22 GMT<![CDATA[Reply to Syslog source became <unknown> on Sat, 11 Jun 2016 00:20:05 GMT]]>Hi Victor,

I'm using zones and "show index nodeaddr" returns nothing.

]]>https://forum.netxms.org/post/20115https://forum.netxms.org/post/20115Sat, 11 Jun 2016 00:20:05 GMT<![CDATA[Reply to Syslog source became <unknown> on Fri, 10 Jun 2016 16:44:37 GMT]]>Hi,

it shows <unknown> in "Source" column of syslog monitor? That means that server was unable to find node object by source IP address or host name. Are you using zones? If not, could you please run command (on NetXMS server console):

nxadm -c "show index nodeaddr"

and check that problematic node's source address is there?

Best regards,
Victor

]]>https://forum.netxms.org/post/20112https://forum.netxms.org/post/20112Fri, 10 Jun 2016 16:44:37 GMT<![CDATA[Reply to Syslog source became <unknown> on Fri, 10 Jun 2016 05:54:20 GMT]]>The IPv4 address of Syslog source does have a node found by using filter ">ip_address" and match its "primary host name" field.

]]>https://forum.netxms.org/post/20103https://forum.netxms.org/post/20103Fri, 10 Jun 2016 05:54:20 GMT<![CDATA[Reply to Syslog source became <unknown> on Wed, 08 Jun 2016 10:19:27 GMT]]>Please run tcpdump (or wireshark or similiar) and look at the actual packets of the incoming syslog messages.

What IP address do they come from?
If you put ">that_ip_address" into the object tree filter, does it find anything (make sure to prefix the IP with ">")?

The source IP address of the syslog message packet gets looked up across all your nodes present in NetXMS.
Are you sure you have a node with the address of the syslog messages present in NetXMS?

Bonus info: are syslogs coming over IPv4 or IPv6?

]]>https://forum.netxms.org/post/20075https://forum.netxms.org/post/20075Wed, 08 Jun 2016 10:19:27 GMT<![CDATA[Reply to Syslog source became <unknown> on Wed, 08 Jun 2016 09:37:17 GMT]]>SyslogIgnoreMessageTimestamp and SyslogNodeMatchingPolicy are 0. It's working properly in 1.2.x branch but not after upgrade to 2.0.x branch.

]]>https://forum.netxms.org/post/20074https://forum.netxms.org/post/20074Wed, 08 Jun 2016 09:37:17 GMT<![CDATA[Reply to Syslog source became <unknown> on Wed, 08 Jun 2016 09:33:11 GMT]]>What are your "SyslogIgnoreMessageTimestamp" and "SyslogNodeMatchingPolicy" server configuration variables configured to?

Also, did you get it working before 2.0.4, or is this the same issue persisting from 2.0.2/2.0.3?

]]>https://forum.netxms.org/post/20072https://forum.netxms.org/post/20072Wed, 08 Jun 2016 09:33:11 GMT<![CDATA[Reply to Syslog source became <unknown> on Wed, 08 Jun 2016 09:18:36 GMT]]>After upgrading to 2.0.4 and performed nxdbmgr upgrade, previously known source in syslog became <unknown>. What's the debug level for Syslog logging?

]]>https://forum.netxms.org/post/20071https://forum.netxms.org/post/20071Wed, 08 Jun 2016 09:18:36 GMT