6 Replies Latest reply on Apr 6, 2011 7:40 AM by cj54487

    Missing Octect in Syslog


      I just purchased Eng Toolset 10.6.x  I have set up the Syslog and have configured several Cisco routers and switches to write to it.  In the hostname column, I notice that some switches and routers are listed by IP address, but the last octet is missing, but most have all octets, or are returning the DNS name.  The switches are all part of the same subnet. Any suggestions?

        • Re: Missing Octect in Syslog

          What Model and IOS Version are the Routers?

          Since other devices are working correctly, there may be an issue with these Devices, or perhaps there is a Firewall between the Devices and Toolset that is changing the information.

          If you connect Toolset to the same Subnet do they continue to have the same issue?

            • Re: Missing Octect in Syslog


              It is happening on one of my eight Cisco 3750 switch stacks (IOS Version 12.2 (55)SE1), the other 7 stacks do not have the problem.  All the stacks have the same IOS and are in the same subnet, which is in a different subnet of the Toolset machine.  I am not able to move the machine from its current subnet.

              On the Cisco 2821 router (IOS Version 12.4(20)T3) sometimes the whole IP come through, sometimes the last octet is missing.

              On the Cisco 3845 router (IOS Version 12.4(3i)) sometimes the whole IP come through, most of the time the last octet is missing.

            • Re: Missing Octect in Syslog

              Thanks everyone.  The issue was a MS patch that caused the problem.  I had to replace the current mswinsck.ocx file with a mswinsck.ocx file from the version of Kiwi Syslog.

              1 of 1 people found this helpful
                • Re: Missing Octect in Syslog


                  That is basically what our Toolset Syslog-Server.Hotfix does but instead of replacing your mswinsck.ocx system wide we place the old (working) version in the Toolset folder and setup a manifest file for the Syslog-Server.exe to point it to the hotfixed version of mswinsck.ocx. That way you can keep the "Microsoft recommended" version of mswinsck.ocx for all other applications on your system.

                  For anyone who is interested in this hotfix they can contact support for it. The hotfix is for Windows XP and later. The two symptoms that indicate you may want this fix are:

                  1. Occasional, truncated fourth octet in addresses.

                  2. Syslog-Server may show the following error ever other time you attempt to send a syslog message:       

                  Cannot send Sylog message. Invalid Argument.



                    • Re: Missing Octect in Syslog


                      Thanks for this info.  I had opened a ticket with Solarwinds Support, and they're instructions were to rename the mswinsck.ocx file and install the free version of the Kiwi Syslog.   Although I didn't like that approach, it does work.  However, I would much rather apply the hotfix you mention.  I will try it and report my results. 

                      Once again thanks.  I greatly appreciate your follow-up and detailed explanation.