1 of 1 people found this helpful
The node name for non-agent devices (i.e. syslog, SNMP, remote devices) is displayed as it is received in the syslog (or SNMP, etc) data.
That is, if your syslog message looks like:
May 11 2012 11:06:00 192.168.168.1 Something_Cool_Happened
LEM will display "192.168.168.1" in the node list. If it looks like:
May 11 2012 11:06:00 main-fw1 Something_Cool_Happened
LEM will display "main-fw1" in the node list.
We aren't doing any name resolution inside of LEM for displaying node data outside of what the native syslog server is doing. We do do name resolution in our correlation engine, so that if "main-fw1" and "main-fw1.domain.local" and "192.168.168.1" are the same thing we correlate them together (as long as we've got reliable DNS), but it's not displayed anywhere, it's pretty much behind the scenes.
For agent nodes, we display the address the appliance sees the agent connect from as a part of the agent's information.
thanks for the heads up!
found this on "ccie pursuit blog" site:
logging origin-id hostname
r4(config)#logg origin-id ?
hostname Use origin hostname as ID
ip Use origin IP address as ID
string Define a unique text string as ID
r4(config)#logg origin-id hostname
The previous network admin managed to set up a bunch of Cisco switches in LEM that are using friendly name but, the origin-id setting is not in their logging config nor is it set in the snmp config.
How do you think he managed that?
Also, we have several Cisco Nexus switches which do not support the 'origin-id' setting, what do we do there?
Seems to me LEM itself should let us set whatever node names we'd prefer. Is that so much to ask? Is it really that hard a feature to add?