Log to syslog using hostname rather than IP address

[BillP]

I would like to see the locally defined hostname in syslog, rather than its IP address.

In other words, I currently see:

2016-06-03T06:18:31-07:00 10.1.100.200 System: Web user 'stuartk' logged in from 10.1.71.40. 0x0015

I would prefer to see:

2016-06-03T06:18:31-07:00 mdf-ups System: Web user 'stuartk' logged in from 10.1.71.40. 0x0015

I have configured the hostname in two places:

[NetworkTCP/IP]

HostName=mdf-ups

[SystemID]
Name=mdf-ups

Does any version of AOS support this?

--sk

[BillP]

Hi Stuart,

I don't see that we offer this today. I see the Syslog RFC here and specifically section 6.2.4 which recommends how things should work for that field: https://tools.ietf.org/html/rfc5424#section-6.2.4 

I can file an enhancement request to look at this capability for a future version instead of showing the IP.

[BillP]

(1) I would argue that the RFC encourages us to log FQDN when possible; this would be the ideal choice, if we're paying strict attention to the RFC.

 The HOSTNAME field SHOULD contain the hostname and the domain name of
   the originator in the format specified in STD 13 [RFC1034].  This
   format is called a Fully Qualified Domain Name (FQDN) in this
   document.

   In practice, not all syslog applications are able to provide an FQDN.
   As such, other values MAY also be present in HOSTNAME.  This document
   makes provisions for using other values in such situations.  A syslog
   application SHOULD provide the most specific available value first.
   The order of preference for the contents of the HOSTNAME field is as
   follows:

   1.  FQDN

   2.  Static IP address

   3.  hostname

   4.  Dynamic IP address

   5.  the NILVALUE

And that since this APC device is configured to know its FQDN,

HostName=mdf-ups
DomainName=corp.alleninstitute.org

it would be capable of logging using its FQDN.

Of course, the RFC says SHOULD rather than MUST, so I would also argue that the current implementation is RFC-compliant (if not "RFC-optimal").

==> Yes, please log an enhancement request

Case:

- Logging FQDN *when possible* adheres more closely to the RFC

- When customers are working with their Network Monitoring Platforms, seeing a hostname makes their lives way easier, as opposed to seeing IP addresses, which tend not to stick well in human memory (aka "mdf-ups" tells me that this is the UPS located in the Main Distribution Frame room ... whereas "10.1.100.200" tells me ... very little, particularly if I own lots of these devices.

- Speaking from my experience only (several decades of syslog grepping .. but still, only one person's perspective), I will claim that virtually all devices log Hostname, very few log IP address.  [My current exceptions:  (a) some 12-year old HP Switches, and (b) my flock of APC devices.]  For example, Windows (equipped with Event Log-to-Syslog forwarding software), Linux, Solaris, Cisco, Juniper, Hitachi, NetApp, Liebert, Enlogic ... all log Hostnames.  Thus, logging Hostname (or FQDN) as opposed to IP address would make APC similar to a substantial majority of other manufacturers.

(2) As an aside, I note that I rarely see a device log using its FQDN ... instead, devices tend to log, by default, using their Hostname, e.g. "mdf-ups" rather than "mdf-ups.company.com".  i.e. choice #3 in the RFC.  Perhaps 'hostname' is easier to implement.

(3) I note that when using the Syslog Test function, APC devices log using their hostname, see here for an example:

2016-06-03T09:27:14-07:00 10.1.100.200 Web user 'stuartk' logged in from 10.1.71.40. 0x0015
2016-06-03T09:29:44.496285-07:00 mdf-ups 06/03/2016 09:29:45 10.128.13.50 APC: Test Syslog.
2016-06-03T09:30:04-07:00 10.1.100.200 Web user 'stuartk' logged out from 10.1.71.40. 0x001F

So I propose that the code to log using Hostname is already included in AOS, although the standard execution path when logging messages does not invoke whatever routine provides this service.

==> Specifically, I propose that AOS log to syslog using its Hostname, if that hostname has been changed from the default, and using its IP address if not.

==> If you are feeling energetic, then provide a checkbox for "Log to syslog using IP address, not Hostname"

--sk

[Anonymous user]

Hi Angela,

We want to raise/file  a enhancement request to log hostname in syslog rather than IP address.

Please help and look in to it asap to get it done.

Thanks,

Ganesh Waghmare

[Anonymous user]

Hi Angela,

Please help us with an update.

Thanks,

Ganesh Waghmare

[BillP · Accepted solution]

Hi,

This was address with the 6.6.5 release of firmware for the NMC. You should update the firmware to the latest rev available on APC.com