I’m new to Graylog and i am now in the process of setting it up.
I have come across a strange thing regarding the “source”-field (syslog):
It seems in some cases the source data shows as a date or the device uptime.
I hooked up a couple of Cisco switches of different models (2960 and 3750) and in graylog they both present like this:
I thougt it was a Cisco issue but then i also hooked or Clavister firewall up and it present the same way but
with a bracket and today’s date as “source”.
I have followed Ciscos recommended steps for setting a interface as source but it does not make any difference.
Is this really a device configuration error or is it in the Graylog conf?