Node discovered with wrong connector

Question

Hello!

I recently got Patch Manager squared away (mostly) for our network, so I've moved on to learning LEM and getting it set up with our network. I have a feeling I'm going to be asking a llloootttt of questions about this one. x_x

Anyways, I've muddled through a few things and finally managed to get LEM to add a router I wanted to monitor. The problem I'm finding is that LEM did not detect the router as the right device - it's a Cisco router, but it discovered it as an Extreme Switch AND a Mikrotik Router. That's right, the same IP showed up in the 'new node discovered' section twice, with each option. This isn't really a problem - I'm able to see the logs from the device when I go to monitor it, and I've started the quest to figure out that part of the program - but it is a little concerning and I wanted to ask here about that.

Does anybody know why LEM might pick up a Cisco router as another vendor's device, and if that will cause any problems with how it reads/sorts/displays the logs? And if it won't cause any problems, do I need to keep the Cisco connector I set up (I used the Cisco CatOS connector since it seemed the best fit for the router I was adding)? I don't know if it's actually doing anything or not.

The router I'm fiddling with is a Cisco 2911, with IOS version 15.2. I'm using local7 as the logging facility (I'm not sure that this matters, so long as the router and LEM use the same one?), and I have the logging level set to debugging.

Thanks in advance!

curtisi · Accepted Answer

First: The device you're messing with is actually going to be parsed under the PIX/IOS connector for LEM. CatOS is for legacy devices running the Catalyst Operating System (which even the Catalyst switches don't use anymore)

Second: The LEM makes a "Best Effort" in matching connectors, and configures every possible match. We'd rather you have too many than not enough and miss data! There's only so many ways to format a 1KB line of text, so there's a lot of similarities between different syslog messages.

You should make an effort to clean up the bad connectors, as they can have an impact on memory and CPU usage in the LEM, and there's no reason to have the LEM attempting to parse logs with the wrong formatting.