Syslog and Cisco Devices

Just copy the running config to Flash and reboot the routers. Else try disabling and enabling logging agin

Ck-NET

What's reported in the syslog output is the DNS resolution of the IP address that was the source address for the UDP syslog packet. If you want to change the name in the syslog output then either 1) change the A record on your NS or 2) add a host file entry for that IP that uses the new name.

HTH J

Hi J,

Thanks for your reply, but i dont think this is exactly right, I have not got reverse lookup's happening for syslog-ng (beacuse of time), and I know that what is being reported is not the dns lookup as the dns name is a lot longer than what is being reported. I have tried what Ck suggested (disable and re-enable logging) but that did not fix it. The next step is to wait till the weekend and restart the router when it is not in use.

Thanks for the replies.

I don't use syslog-ng but I know for certain the sysklogd works the way I described. Without a DNS entry what's logged is the barenaked IP address. Rather than request A records from a 3rd-party I simply added hosts file entries with the shortname of each device. I've done this at numerous clients. You're right though. I tested syslog just now with logger and syslog didn't log the IP of the connecting machine for the 4th field. It logged what the remote host gave it, if it gave anything at all.

I sniffed the actual syslog output to learn a bit more about syslog. sysklogd (I can't speak for syslog-ng but it should work in a similar manner) will log the results of a DNS lookup in the 4th field if no hostname is given in the datagram. The output of my sniff showed all 3 fields of the date stamp followed by the Cisco output detailing what was logged. In this case the output was %SYS-5-CONFIG_I: Configured from console by username on vty0 (aaa.bbb.ccc.ddd)". Neither the Cisco router or switch I tried provided any output that pertained to which host provided the output. Yet syslog logged the hosts name I provided for one of the IPs and the A record for the other IP. Cisco devices don't send their FQDN or even their hostname in the syslog output.

Syslog-ng may operate differently but this is how GNU sysklogd operates. Hope this helps give some insight.

PS==> I've been meaning to give syslog-ng a try. One of these days....

Try this configuration command in the router.

logging origin-id hostname