<p dir="ltr">Thanks for the responses, all. I managed to fix the issue by routing the syslog messages to a different interface on the server. </p>
<p dir="ltr">Sent from my Android device.</p>
<div class="gmail_quote">On Mar 9, 2015 4:53 AM, &quot;Sandor Geller&quot; &lt;<a href="mailto:sandor.geller@ericsson.com">sandor.geller@ericsson.com</a>&gt; wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
Is it possible to configure the given device to use another port? This<br>
way you could fire up another syslog-ng instance with debugging options<br>
enabled to see what it thinks about the incoming messages. Running this<br>
instance under strace won&#39;t impact the processing of logs from other<br>
devices and the strace output would be quite useful for debugging.<br>
<br>
Although you mentioned that the incoming logs seem to be OK could you<br>
show a few incoming packets? Preferably in hexdump format, maybe we<br>
could catch what&#39;s wrong.<br>
<br>
Regards,<br>
<br>
Sandor<br>
<br>
On 03/06/2015 07:09 PM, Brandon Kendall wrote:<br>
&gt; Sorry, I should have specified that.<br>
&gt;<br>
&gt; Not only does the hostname resolve to the correct IP, I created an entry<br>
&gt; in the hosts file for this device.<br>
&gt;<br>
&gt; Thanks!<br>
&gt;<br>
&gt; On Fri, Mar 6, 2015 at 12:30 PM, Sandor Geller<br>
&gt; &lt;<a href="mailto:sandor.geller@ericsson.com">sandor.geller@ericsson.com</a> &lt;mailto:<a href="mailto:sandor.geller@ericsson.com">sandor.geller@ericsson.com</a>&gt;&gt; wrote:<br>
&gt;<br>
&gt;     Hi!<br>
&gt;<br>
&gt;     The only macro in the destination which isn&#39;t generated by syslog-ng<br>
&gt;     itself is $HOST as you are using DNS for hostname resolution. Could you<br>
&gt;     doublecheck that the source IP address of the originating device<br>
&gt;     resolves properly to a hostname and the given hostname is unique?<br>
&gt;<br>
&gt;     hth,<br>
&gt;<br>
&gt;     Sandor<br>
&gt;<br>
&gt;     On 03/06/2015 05:56 PM, Brandon Kendall wrote:<br>
&gt;      &gt; Hello everyone.<br>
&gt;      &gt;<br>
&gt;      &gt; I have a centralized syslog-ng server running that collect syslog<br>
&gt;      &gt; messages from Cisco firewalls. The .conf file is very straightforward<br>
&gt;      &gt; and contains the following:<br>
&gt;      &gt;<br>
&gt;      &gt; options {<br>
&gt;      &gt; use_fqdn(no);<br>
&gt;      &gt; use_dns(yes);<br>
&gt;      &gt; dns_cache(yes);<br>
&gt;      &gt; dns_cache_size(2000);<br>
&gt;      &gt; dns_cache_expire(87600);<br>
&gt;      &gt; keep_hostname(no);<br>
&gt;      &gt; long_hostnames(no);<br>
&gt;      &gt; flush_lines(0);<br>
&gt;      &gt; normalize_hostnames(yes);<br>
&gt;      &gt; create_dirs(yes);<br>
&gt;      &gt; dir_group(group_name);<br>
&gt;      &gt; dir_perm(0751);<br>
&gt;      &gt; stats_freq(600);<br>
&gt;      &gt; stats_level(1);<br>
&gt;      &gt; group(group_name);<br>
&gt;      &gt; perm(0640);<br>
&gt;      &gt; };<br>
&gt;      &gt;<br>
&gt;      &gt; source s_network_1 {<br>
&gt;      &gt; udp();<br>
&gt;      &gt; };<br>
&gt;      &gt;<br>
&gt;      &gt; destination d_network_1 {<br>
&gt;      &gt; file<br>
&gt;      &gt;<br>
&gt;     (&quot;/var/syslog/$R_YEAR-$R_MONTH-$R_DAY/$HOST/$R_YEAR-$R_MONTH-$R_DAY-$HOST-$R_HOUR.log&quot;);<br>
&gt;      &gt; };<br>
&gt;      &gt;<br>
&gt;      &gt; log {<br>
&gt;      &gt; source(s_network_1);<br>
&gt;      &gt; destination(d_network_1);<br>
&gt;      &gt; };<br>
&gt;      &gt;<br>
&gt;      &gt;<br>
&gt;      &gt; The goal is to have the logs from each device arranged in a hierarchy<br>
&gt;      &gt; that is as follows (simplified):<br>
&gt;      &gt; Date/device_name/hour-1.log<br>
&gt;      &gt; Date/device/name/hour2.log<br>
&gt;      &gt; etc<br>
&gt;      &gt;<br>
&gt;      &gt; This has been working great.<br>
&gt;      &gt;<br>
&gt;      &gt; Recently I configured another network device to send syslog<br>
&gt;     messages to<br>
&gt;      &gt; this server, and they aren&#39;t being logged. Using tcpdump on the<br>
&gt;      &gt; syslog-ng box, I&#39;ve verified the messages are making it to the server<br>
&gt;      &gt; from the network device. They are UDP and using the correct port.<br>
&gt;     I&#39;ve<br>
&gt;      &gt; compared the message format in the pcap to other devices that are<br>
&gt;     still<br>
&gt;      &gt; logging and everything matches. I have no errors in /var/log/syslog<br>
&gt;      &gt; files, nor do I have errors in /var/log/messages.<br>
&gt;      &gt;<br>
&gt;      &gt; I&#39;ve hit a dead end in troubleshooting, since all other devices<br>
&gt;     sending<br>
&gt;      &gt; logs to this server are being correctly written to log files. Can<br>
&gt;      &gt; someone point me to anything else to check?<br>
&gt;      &gt;<br>
&gt;      &gt; This is syslog-ng 3.1.2 running on RHEL 5.8.<br>
&gt;      &gt;<br>
&gt;      &gt;<br>
&gt;      &gt; Thanks!<br>
&gt;      &gt;<br>
&gt;      &gt;<br>
&gt;      &gt;<br>
&gt;     ______________________________________________________________________________<br>
&gt;      &gt; Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
&gt;      &gt; Documentation:<br>
&gt;     <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
&gt;      &gt; FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
&gt;      &gt;<br>
&gt;<br>
&gt;     ______________________________________________________________________________<br>
&gt;     Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
&gt;     Documentation:<br>
&gt;     <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
&gt;     FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; ______________________________________________________________________________<br>
&gt; Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
&gt; Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
&gt; FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
&gt;<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>