Syslog from secondary node IP's

If it's a cisco device make sure the nodes are in NPM based on loopback address usually loopback0 and then add the following:

logging trap debugging
logging facility syslog
logging source-interface Loopback0
logging xxx.xxx.xxx.xxx  <--- put your NPM servers IP here

typically that is why management systems best practices say to use loopback addresses (never go down) and you configure your devices to source SNMP and syslog from the loopback.

I also add the following:

snmp-server community xxxx RO 98
snmp-server community xxxx RW 98
snmp-server ifindex persist
snmp-server location xxxxx
snmp-server contact xxxxx
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server enable traps tty
snmp-server enable traps bgp
snmp-server enable traps config
snmp-server enable traps syslog
snmp ifmib ifindex persist

In the event of an edge case where I am unable to configure things this way is there anyway to solve this problem?

This makes me curious why Orion doesn't associate IP's with the other interfaces it discovers on nodes, it seems it would be beneficial to do so.

Hi Byrona,

It's definitely best to configure your devices for source interfaces, but in the event you can't - just add ICMP Only or External Nodes with the IP address in question.

Not the best solution. - but I've done it with externally managed devices that might use HSRP or VRRP.

- v

I've got a SQL script that pulls IPs/masks from NCM to NPM interfaces to custom properties to populate on map for live documenting, but i see what you're saying where traps/syslog sourced from one of those aren't associated with the node itself...

I think this is a feature request or something SW has to comment on...

Yes,

Our solution is to discover or change the ip address(in solarwinds) of the offending node to the ip address that the syslog message is coming from.

This should do it.

Totally agree with best practice of using loopback0 for all sources (logging, snmp, tacacs etc) for consistency. However that aside, Orion is not YET capable of being aware of a router with multiple IP addresses and aware of network reachability (ie: hsrp) hence one of the main reasons some companies are hesitant to pack up their Openview NNM systems just yet. 

You can do what viol8tor suggested and add those extra HSRP IP's as ICMP only nodes so you at least monitor the up/down status of them.

Hi bryron--

Not sure but this may be a feature that NPM dev is working on for the next release. See this post, look under Syslog and Traps, Items 6 and 8.

Let me know if this helps.

M