[syslog-ng] Cisco Loadbalancer and Syslog-ng

[Geller, Sandor (IT)]

> Hi everyone,
> Our syslog-ng server is logging all our cisco css 
> (arrowpoint) syslogs into a file called "5". For all the 
> other network devices, it is getting correctly logged under 
> the host IP. Has anyone experienced this behavior ? Is there 
> a workaround?
> -ajay

tcpdump is your friend to check what is arriving on the wire.
I wouldn't be surprised if your Ciscos violated the syslog
protocol. Syslog-ng supports several log formats, so you should
at least show what format the Ciscos are using. BTW what version
of syslog-ng are you running?

Regards,

Sandor
--------------------------------------------------------

NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.