cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
  • About JohnPaulPagano

Re: Meraki and Syslog-NG

by in Full-Stack & Network-Wide
‎05-31-2021 05:50 PM
‎05-31-2021 05:50 PM
Thanks for your reply. I have tried all of the Syslog-NG network drivers that seem relevant: default-network-drivers(), network(), and udp().   I suspect that Meraki's choice to send UNIX "epoch" timestamps--i.e, "1622231783.881009670"--rather than those formats specified in the syslog RFCs is a problem.  ... View more

Meraki and Syslog-NG

by in Full-Stack & Network-Wide
‎05-28-2021 03:43 PM
‎05-28-2021 03:43 PM
Hi,   I've been struggling epically to export legible logs from my Meraki devices to a server running Syslog-NG OSE 3.30. No matter what source driver I use on the server, I see errors like this (identifying details changed):   May 28 15:56:23 syslog-ng[32734]: Error processing log message: <134>1>@< 1622231783.881009670 HOSTNAME1 flows allow src=10.1.1.1 dst=10.2.1.1 mac=BLAH protocol=icmp type=0 May 28 15:56:23 syslog-ng[32734]: Error processing log message: <134>1>@< 1622231783.857281611 HOSTNAME2 flows allow src=10.1.1.2 dst=10.2.1.2 mac=BLAH protocol=icmp type=0 Is it possible that Meraki doesn't send messages that conform to RFC3164 or RFC5424? And if so, does that mean I have to parse them specially on my Syslog-NG server with an XML file in patterndb? Can anyone point to an example of one that I can look at?   Thanks!   ... View more
© 2023 Meraki