[logs] Bracket source IP address in syslog files

From: Limpach, Patrick (Patrick.Limpachat_private)
Date: Thu Mar 27 2003 - 12:00:07 PST

  • Next message: Brian Anon: "[logs] NetIQ Vigilant Log Analyzer?"

    > All,
    > I am running the standard syslog facility for Solaris 2.6, collecting
    > syslog info from Cisco routers.
    > Our log parsing scripts key on the source hostname, and recently, we
    > started seeing a bracketed, 6 octet string in place of some of some of the
    > host names.  The first 4 octets are an IP address from the router (not the
    > loopback address), and the last 2 octets are consistent for each IP
    > address, but I have no clue what they represent.  We have router loopbacks
    > assigned and in DNS to aid network management.
    > 
    > Example:
    > Mar  3 13:03:23 ciscorouter.domain.com <deleted>
    > Mar  4 13:02:20 [10.99.100.99.228.67] <deleted>
    > 
    > Any ideas on why am I getting bracketed IP's, what are the final 2 octets
    > ?
    > 
    > RFC 3164 states a hostname or dotted decimal IP, but I cannot find the
    > format I am seeing.
    > 
    > Thanks,
    > 
    > Patrick Limpach                   patrick.limpach@national-city.com
    > EPS Automation                  216-257-7744
    > National City Corporation
    > 
    
    _______________________________________________
    LogAnalysis mailing list
    LogAnalysisat_private
    http://lists.shmoo.com/mailman/listinfo/loganalysis
    



    This archive was generated by hypermail 2b30 : Thu Mar 27 2003 - 15:48:46 PST