Top Sources issue

Graylog Central (peer support)
1

Hello everyone,

SOURCES tab, TOP SOURCES:

They shows like that:
Top sources
id=firewall 98.90% 8,888
%snmp-w-snmpauthfail: 0.27% 24
%securitysuite-i-secsynblocked: 0.16% 14
fanctld.sh: 0.16% 14
cfg 0.13% 12
voip-sw-03 0.10% 9
gui 0.07% 6
%link-w-down: 0.07% 6
%link-i-up: 0.07% 6
%stp-w-portstatus: 0.06% 5
Others
%environment-i-fans-speed-chng: 0.02% 2
nasapi 0.01% 1

Instead of that SOURCES I would like to see Sources IP addresses
I could not find the option to change it
Thank you.

2

The sources page simply shows some statistics and aggregates over the “source” field of messages.

If you want so see anything else on the sources page, you’ll have to take care that your messages have the respective values in their “sources” field.

3

Hi jochen,

I found the option in appliance-syslog-udp input to Override source(optional)
It says

The source is a hostname derived from the received packet by default. Set this if you want to override it with a custom string.

What the STRING should I insert to get only IP addresses of sources?

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.