3 Replies Latest reply on Mar 8, 2016 11:30 AM by nicole pauls

    LEM filtering for System Name versus IP

    byrona

      I often need to search for logs across a specific set of nodes managed by LEM, when doing this I normally use the "DetectionIP" as the key field.  The problem that I am running into is I can't use the IP's of the systems like I want, I instead have to use the actual name of the system because LEM has resolved it.

       

      For a field called DetectionIP I guess I expect that should always be an IP and never a system name.  If LEM does resolve the system name that should be stored in a different field.  The problem that this causes is inconsistency in the DetecionIP field where I never know for sure if it's going to be an IP or a system name.

       

      Any thoughts on how to get around this issue?

       

      Thanks in advance for any suggestions.

        • Re: LEM filtering for System Name versus IP
          nicole pauls

          Essentially DetectionIP/InsertionIP are ways of saying "this is where the data originated" and "this is the trusted endpoint that parsed it" (similar to Detection/InsertionTime). DetectionIP is a parsed field (from the log data/messages) unless it's not present, then it's the same value as InsertionIP (which is taken from the agent/manager's detected hostname/IP). 

           

          Yeah, having "IP" instead of "Name" or "Point" is a little confusing.  LEM is also not doing name resolution on the data that is presented, it's literally what came in the logs - so if the log logs a Name, it'll be a name (like windows event logs) when you see it in the console (and when you search). There is some name resolution in the backend correlation engine to resolve this scenario (correlate events where an IP or name comes in the same field), but it's not exposed anywhere else.

           

          Valid related question is where and when you might expect the resolution to take place - on the fly when you're searching, from the server or on the console?

          2 of 2 people found this helpful
          • Re: LEM filtering for System Name versus IP
            nicole pauls

            Correct - as it is, there's no guarantee that any field will be an IP vs. name 100% of the time across 100% of devices. It depends on the data (log) source and agent node.

            1 of 1 people found this helpful