ArubaOS and Controllers

Reply
New Contributor
Posts: 3
Registered: ‎12-03-2010

Question about syslog message format

Hi Forum,

One of our customer using Aruba 200 -US and sending syslog message to an syslog server. However, we are facing some difficulty to parse those syslog message because they are not following RFC 3164 standard. The problem is: timestamp. Please check followed message that sent by Aruba 200:
LOCAL1.DEBUG: Nov 15 16:52:31 2010 sapd: <326001> |AP pkwap-mktg1@192.168.240.165 sapd| AM: process_eif_packet: xxx

RFC 3164 defined time stamp in BSD format without year (RFC 5464 defined time stamp in ISO format which include year but no space within it). And after time stamp, there's a space and then hostname. So, now most syslog server will consider year as hostname.

May I know how can we recommend our customer to change their setting in Aruba 200 to send syslog message in correct format?

BTW, Aruba Operating System Software.

ArubaOS (MODEL: Aruba200-US), Version 3.3.1.12
----------------------------------
Partition : 0:0 (/dev/hda1) **Default boot**
Software Version : ArubaOS 3.3.1.12
Build number : 18688
Label : 18688
Built on : 2008-06-14 20:09:41 PDT
----------------------------------
Partition : 0:1 (/dev/hda2)
Software Version : ArubaOS 3.1.1.7
Build number : 16658
Label : 16658
Built on : 2007-10-31 14:53:06 PDT


Thanks

Wei
New Contributor
Posts: 3
Registered: ‎12-03-2010

Re: Question about syslog message format

Nobody? Help please!

Wei
Aruba Employee
Posts: 455
Registered: ‎04-02-2007

Re: Question about syslog message format

The format is not adjustable.

-awl
Andy Logan, ACDX
Director, Strategic Account Solutions
Aruba Networks
New Contributor
Posts: 3
Registered: ‎12-03-2010

Re: Question about syslog message format


The format is not adjustable.

-awl




And it was wrong? Thanks for your reply.

Wei
Aruba Employee
Posts: 455
Registered: ‎04-02-2007

Re: Question about syslog message format

Actually the format specified in the RFC is not required. From section 4:

In essence, it is RECOMMENDED to transmit a syslog message in the format specified in this document, but it is not required.
Andy Logan, ACDX
Director, Strategic Account Solutions
Aruba Networks
Search Airheads
Showing results for 
Search instead for 
Did you mean: