Enabling RFC3164 Header Information Alters Forwarded Syslog Messages

Explanation:

In forwarding syslog messages, if the RFC3164 header is included, the server elides the year specification in the Date filed, adds a "Kiwi_Syslog_Server" string to the message, and includes additional Date/Time stamps.

For example:

[truncated] Syslog message: LOCAL7.WARNING: May 10 2011 16:45:56: %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 20 per second, max configured rate is 10; Current average rate is 45 per second, max configured rate i…

It then forwards it as this:

[truncated] Syslog message: LOCAL7.WARNING: May 10 15:58:26 10.62.5.20 Kiwi_Syslog_Server May 10 2011 15:58:26: %ASA-4-106023: Deny tcp src PROD-DMZ-MISC:10.62.37.22/51730 dst STAGE-DMZ-MISC:stage-cron.test.liquidation.com/25 by access-gro

Resolution:

The solution is to disable Send with RFC3164 header information.

Open Settings (File > Setup)
Click the Forward to another host action in the left pane.
Uncheck Send with RFC3164 header information.

No related articles were found.

Attachments

No attachments were found.

Visitor Comments

No visitor comments posted. Post a comment

Post Comment for "Enabling RFC3164 Header Information Alters Forwarded Syslog Messages"

If this article does not provide the solution you need, please consider visiting our community forums on thwack or contacting SolarWinds Support. Please use the following form to provide comments that help us improve this KB article. Fields marked with an asterisk are required.