Graylog Source-field configuration error?

Graylog Central (peer support)
1

Hello!
I’m new to Graylog and i am now in the process of setting it up.

I have come across a strange thing regarding the “source”-field (syslog):
It seems in some cases the source data shows as a date or the device uptime.

I hooked up a couple of Cisco switches of different models (2960 and 3750) and in graylog they both present like this:
Source: 22w1d

image

I thougt it was a Cisco issue but then i also hooked or Clavister firewall up and it present the same way but
with a bracket and today’s date as “source”.
Source: [2018-01-17

I have followed Ciscos recommended steps for setting a interface as source but it does not make any difference.
Is this really a device configuration error or is it in the Graylog conf?

Best regards
Bjorn

2

everything points that the syslog message is in some dialect that is not supported by Graylog.

You might want to switch to a “RAW/Plain text” input and parse the fields yourself out of the messages.

The second option is to ask the vendor how you can send a log message that is compliant to RFC 3164 or RFC 5424.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.