Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Source of standard syslogs from Firepower devices coming from out of band management so Orion drops them.

We have a Firepower 1120 standalone system (no FMC) . The syslogs have been configured to point to our Orion box, which 2020.2.4. The Orion (NPM only) box GETS the syslogs, but because it cannot match the source IP with any of the IP addresses on the monitored 1120 Firepower system, it drops the logs. When I do a list resources on the box in Orion I get all the interfaces except the OOB management interface. Is there a way to get Orion to accept these syslog messages coming from a system that it is monitoring?

Find more posts tagged with

Accepted answers

jm_sysadmin

If the management IP isn't isn't discovered on the node' s primary IP inventory I have either switched to monitoring the management interface (sometimes it has all the devices information) or I just add a second node to handle it.

All comments

jm_sysadmin

Chris-S

Thank you jm_sysadmin! That's a great idea! I did try to add it as a "second" node with the OOB management IP and unfortunately SNMP only responds from the data interfaces, not from the out of band management interface. I will check with Cisco to find out if there is a way to direct the SNMP data out the OOB interface instead of out the data interfaces.

Chris-S

Nevermind, jm... your solution worked. I had it in my brain that I had to add it as an SNMP node. However, I just added it as a second node but via ICMP only and I'm getting the syslogs now. Thank you!

planglois

With the legacy syslog viewer there was a config flag to allow messages from unmonitored devices... I just learned from support it's not there anymore with OLV... I now have to revert to legacy trap and syslog viewer and find a solution until they completely removed the apps...