<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2658.34">
<TITLE>Cisco Syslog: Wireless Controller Messages</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2 FACE="Arial">Hello everyone, and happy holidays! I came across a weird issue with syslog-ng, and messages coming from the Cisco Wireless Controller devices. When I use ngrep to do a capture from the wire, the alert looks like this:</FONT></P>
<P><FONT SIZE=2 FACE="Arial"><130> Dec 21 19:20:24.474 iapp_socket_task.c:580 IAPP-3-MSGTAG015: iappSocketTask: iappRecvPkt returned error</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">However, after running through syslog-ng and getting to my syslog file it appears like this (numbers different, message the same):</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Dec 21 16:01:27 .839 iapp_socket_task.c:580 IAPP-3-MSGTAG015: iappSocketTask: iappRecvPkt returned error</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">So, it appears as though syslog-ng is pulling the milliseconds from the alert (the .839 in the second example) and moving it to the 4th token spot, instead of leaving it attached. Anyone seen this behavior, and more importantly, what do we need to do to fix it? I am on syslog-ng version 1.6.11. Thanks in advance!!!</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Chris Ivey</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Affiliated Computer Services</FONT>
<BR><FONT SIZE=2 FACE="Arial">Enterprise Management Integration Services</FONT>
<BR><FONT SIZE=2 FACE="Arial">Infrastructure Management Senior Analyst</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">chris.ivey@acs-inc.com</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">"I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison</FONT>
<BR><FONT SIZE=2 FACE="Arial">"When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes</FONT>
<BR><FONT SIZE=2 FACE="Arial">"I reject your reality, and substitute my own!" -- Adam Savage</FONT>
</P>
</BODY>
</HTML>