Folks I have three Ciscos that are added as devices in Kiwi. Each sends the correct info to the syslog server as tested with WireShark. Kiwi shows the correct source IP from two machines but shows the other as 127.0.0.1 Thing is it is random. If I delete the working device and restart Kiwi the non working one from before delete/restart now shows correct? I am on the 5 licence latest version on WinXP SP3 Pro server all ports default. If I shut down Kiwi and run The Dude syslog shows in its syslog page the correct IP from all the remote Cisco devices (10.1.0.50) any ideas?
Is this a brand new install of Kiwi? I'd have to see your configuration to see what's going on. Are you using the static hosts file for DNS resolution? Are you filtering and forwarding messages back to Kiwi? Some devices have the option to send message as host and allow you to specify an IP address for the host or allow you to specify which Interface IP address is used for logging regardless of which interface the logs actually go out. But if another Syslog server is showing things correctly, I think it has to be a rule or setting in Kiwi somewhere.
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 150,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process. Learn more today by joining now.