Hello, We have a Cisco ASA running Firepower services. Upon configuring this device to send syslog data to our graylog server, we are noticing that the source name of these syslog messages shows as “Nov” . Our firewall’s hostname is not “NOV” but “ciscoasa”. How to make Graylog show the correct h…

im using raw plaintext input, for all cisco devices // Anders

@dio99 , does that give you the right hostname ? if i use plain text , it shows source as the “IP-address of the interface”

set the logging device-id in the cisco device that will give u the name in the message, but u can also let graylog to resolve the ip if u have the FW in the dns if u want to have hostname in source…

if you enable store full message in the input config, you will see what the device send. check it first, then the syslog standards, and you will understand why you got it. a lot of devices don’t use the syslog standards, youst send a string what looks like that. Graylog use the standards. You c…

You might want to read that: [image] Working with Cisco ASA / Nexus on Graylog It is hard to have a working centralized logging environment when you run network devices. Every vendor has his own version and understanding of syslog. Additional most did not speak any kind of structured log …

Thank you all. Appreciate your help. My issue is not resolved, looks like i would have to do some manual work such as creating extractors.

i have done all my cisco ASA in pipelines, moved from extractors since the overhead of matching on a input since i have many devices to normalize :slight_smile: and cisco logg format is a pain in the… due all diffrent ways how it looks :frowning:

you will not get one open source and free to use tool that can work with any device that will be without any work from you outputting something you like to have … so, paying someone money to do the work or do the work yourself is the only option you have.

[image] jan: so, paying someone money to do the work or do the work yourself is the only option you have. Well, there’s always good ol’ Begging and Pleading™, or telling someone that “It will look good on your resumé or portfolio, just do it for free.” :wink:

Hi Jan, Please see below sample message from our Cisco-ASA. My requirement is to correct the source field to show "Cisco-ASA" instead of “Nov” as what Graylog shows currently. So, In order to fix / overwrite the source field of my incoming cisco syslog messages, i wrote the below 3 pipeline rules…

Source name in the Cisco Firepower Syslog

Graylog Central (peer support)

jan (Jan Doberstein) November 21, 2018, 8:43am 6

You might want to read that:

Cisco 3750 logs showing date as source

Topic		Replies	Views
Making source field show hostname instead of ip-address Graylog Central (peer support) pipeline-rules	5	12386	December 11, 2018
Problem with Cisco Routers / Switches with source value Graylog Central (peer support) pipeline-rules	2	2204	June 24, 2020
Source = :[ cisco syslog, any good way of fixing this? Graylog Central (peer support) pipeline-rules	3	1170	June 23, 2021
Source client appears as a month name instead of its IP/hostname Graylog Central (peer support)	4	2116	December 20, 2017
Cisco 3750 logs showing date as source Graylog Central (peer support)	3	565	May 18, 2023

Source name in the Cisco Firepower Syslog

Related topics