Wireless Access

Reply
Contributor II
Posts: 46
Registered: ‎06-19-2015

Controller Hostname not showing on Syslog server

I am attempting to send syslogs from an Aruba Mobility 7210 controller to a central syslog server running Linux rSyslog. All of my other devices are showing up on that syslog server with dynamic directories based on the Hostname of the device, except the Aruba Controller. The Aruba controller is just creating a directory of the current year (2016)

My syslog server is configured to create dynamic directories with these variables: 

/var/log/TMNetLogs/%HOSTNAME%/%$YEAR%/%$MONTH%/%HOSTNAME%.log

 

So the Aruba controller ends up creating a directory like this:

 

TMNetLogs/2016/2016/09/2016.log

 

I do have an actual hostname configured on the Aruba Controller, so why is it not passing this information along to the syslog server? I would be thinkning this would be a problem with the syslog server, except that my other devices are working fine, only the Aruba is showing up wrong. 
Anything I can do here to fix this?

MVP
Posts: 707
Registered: ‎12-01-2010

Re: Controller Hostname not showing on Syslog server

I suspect your rsyslog implementation is expecting a different format syslog message than Aruba is sending. Here's a syslog from one of my controllers (091aw009 is the hostname)

Sep 26 00:35:25 2016 092aw009 stm[3860]: <501097> <WARN> <092aw009 10.30.16.9>  Assoc request: e8:3a:12:ac:01:3d: Dropped AP 10.30.16.245-04:bd:88:be:60:81-092-ap-046 for STA DoS protection

Note that Aruba adds the year where many devices do not. You may have to tell rsyslog how to handle multiple formats.

--Matthew

if I've helped, please give kudos
if I've provided a solution, please mark the solution so others can find it
Contributor II
Posts: 46
Registered: ‎06-19-2015

Re: Controller Hostname not showing on Syslog server

How do you have your Aruba hostname configured? Nothing special, just the standard hostname from the Management>SNMP section?

I will look into different formats that the rSyslog server might be able to understand. 

Search Airheads
Showing results for 
Search instead for 
Did you mean: