Syslog Question

My boss comes up to me one day and says he wants to run a syslog server on his desktop, so he can see whats happening on the network . I told him that we are running a syslog server on Orion and that he can simply go to the Syslog tab in Orion and see what he wants. He said no, I want to have it on my desk. So I installed the Network Engineers edition up on his computer and ran the syslog on his computer. Instead of going out to every device on our network and changing the address for syslog, I just created a filter in the Orion syslog server and forwarded the messages to his desktop. This is working great, with one small caveat all messages are coming from hostame Orion.tollbrothersinc.com. Is there a way to set this up so he knows exactly what node is sending the syslog message with little changes to any part of my network. Please help if you can folks.

Thanks in advance,

bret

Find more posts tagged with

syslog_forwarding

Accepted answers

All comments

rkawell

On Cisco I have configured my remote devices for 'logging origin-id hostname' (or ip address) This adds the hostname in the syslog message, which will be forwarded in the message. Although, it is not supported on some IOS.

I know that this doesn't really help, since it requires you to "touch" each device.

kindbro

All of our devices are being seen by Orion as their original hostname, its just when I set up filter in the Orion Syslog Server to forward messages to another syslog server where im having the problem. If I add this line logging origin-id hostname will it help if its passed from Orion?

rkawell

Yes, because it will put the hostname or IP address in the message that the device is sending and not just in the message header. When forwarding the syslog messages from Orion, the syslog message appears that it was sent from the orion server, but the actual message will have the hostname of the device.

kindbro

This is great and would probally work, but my boss is like I didnt have to do that at my last job. I asked him if he had all his devices setup to point to his machine and he said, they were pointing to a kiwi server and he was then pulling info off the kiwi server to his desktop. Im confused now, he said to open a case with Solarwinds support UGGGGGG.

Bret