# Source = :\[ cisco syslog, any good way of fixing this?

**URL:** <https://community.graylog.org/t/source-cisco-syslog-any-good-way-of-fixing-this/20130>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [June 9, 2021, 12:29pm UTC](https://community.graylog.org/t/source-cisco-syslog-any-good-way-of-fixing-this/20130 "2021-06-09T12:29:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ketil](https://avatars.discourse-cdn.com/v4/letter/k/3be4f8/32.png) [@ketil](https://community.graylog.org/u/ketil)\
**Post date:** [June 9, 2021, 12:29pm UTC](https://community.graylog.org/t/source-cisco-syslog-any-good-way-of-fixing-this/20130/1 "2021-06-09T12:29:51Z")

</div>

We are currently trying to get a better understanding of a older network running some cisco services which generate a lot of broadcast traffic / multi cast traffic etc.  
The traffic is expected but after an upgrade, we have noticed that 17 of the cisco 3850 switches are experiences a bit more broadcast than expected.  
I am therefor trying to get a better understanding of the situation but have run into a bit of a interesting situation, which i am not 100% how to deal with.

when graylog recieves the log, all syslog entries regarding the broadcast storm is maked as “:[” under source, I guessing its because the actual login line on the switch looks like this, without any src specification besides the Te1/1/4 etc.

001838: Jun 9 14:01:51.615: %STORM\_CONTROL-3-FILTERED: A Broadcast storm detected on Te1/1/4. A packet filter action has been applied on the interface.  
001839: Jun 9 14:02:00.004: %STORM\_CONTROL-3-FILTERED: A Broadcast storm detected on Te1/1/3. A packet filter action has been applied on the interface.  
001840: Jun 9 14:03:02.927: %STORM\_CONTROL-3-FILTERED: A Broadcast storm detected on Te1/1/3. A packet filter action has been applied on the interface.  
001841: Jun 9 14:03:54.315: %STORM\_CONTROL-3-FILTERED: A Broadcast storm detected on Te1/1/4. A packet filter action has been applied on the interface.  
001842: Jun 9 14:04:05.865: %STORM\_CONTROL-3-FILTERED: A Broadcast storm detected on Te1/1/3. A packet filter action has been applied on the interface.  
001843: Jun 9 14:04:12.135: %STORM\_CONTROL-3-FILTERED: A Broadcast storm detected on Te1/1/4. A packet filter action has been applied on the interface.  
001844: Jun 9 14:04:54.075: %STORM\_CONTROL-3-FILTERED: A Broadcast storm detected on Te1/1/4. A packet filter action has been applied on the interface.

 ![graylog no src](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/b/b38299f905e088961318629ec3beba7ed85b5efc.png)

Is there any src inforamtion that can be used to tag the package in a manner so I can specific the src address of the switch, taken from the IP header(encapsulation part of the udp) Or something similar to this?

I hope the questions isn’t to scattered.

All the best  
ketil

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [June 9, 2021, 12:45pm UTC](https://community.graylog.org/t/source-cisco-syslog-any-good-way-of-fixing-this/20130/2 "2021-06-09T12:45:55Z")

</div>

Hi @ketil  
it’s because Cisco don’t follow syslog protocol standard. So better way is to use Raw Syslog input and use custom extractors or pipeline rules to extract data to own fields.

If you only want to fix source field, so it contains ip of switch, use this simple pipeline rule which replace source field using ip of device sending logs from graylog internal field `gl2_remote_ip`.

```auto
rule "Set Source IP"
when
has_field("message")
then
set_field("source", to_string($message.gl2_remote_ip));
end

```

PS: If you want to change only for cisco switches, add another condition to when clause

---

<div class="post-metadata">

**Author:** ![ketil](https://avatars.discourse-cdn.com/v4/letter/k/3be4f8/32.png) [@ketil](https://community.graylog.org/u/ketil)\
**Post date:** [June 9, 2021, 6:15pm UTC](https://community.graylog.org/t/source-cisco-syslog-any-good-way-of-fixing-this/20130/3 "2021-06-09T18:15:47Z")

</div>

Thanks, We now have exactly what we where looking for and data is slowly being sucked up and showing in a manner which will make sense over time 🙂  
have a great day and thanks for the help.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/e/ef020f90e785e355ce64e7731f797144baa9af24.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 23, 2021, 6:15pm UTC](https://community.graylog.org/t/source-cisco-syslog-any-good-way-of-fixing-this/20130/4 "2021-06-23T18:15:58Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.