Disabling the syslog "last message repeated x times" message

  • 0
  • 1
  • Question
  • Updated 4 years ago
Hello,

I have some Extreme devices sending to a remote syslog server, Is there away to disable the "last message repeated x times" feature and have it send the whole message?

It's messing up our filtering on the remote syslog server
1) it doesn't send the hostname/ip address with the message
2) we don't know which message is getting repeated as we aggregate the syslog messages from all of our devices to provide a live view of the network.

Example of the message we see in our remote syslog is

May 25 23:04:38  exsshd: last message repeated 4 times
May 25 23:42:37  exsshd: last message repeated 4 times
May 26 00:45:19  SNMP.Master: last message repeated 2 times
May 26 01:15:58  exsshd: last message repeated 2 times

Ideally we need it to be the full message each time, eg


May 28 14:27:54 <IP> exsshd: SSH connection from sourc <IP>#012 has been denied by access-list mgmt_access. Rejecting connection.

Is this possible?

Thanks


Photo of David Wilkinson

David Wilkinson

  • 90 Points 75 badge 2x thumb

Posted 4 years ago

  • 0
  • 1
Photo of Sumit Tokle

Sumit Tokle, Alum

  • 5,738 Points 5k badge 2x thumb
On syslog server, you should see the switch IP address for all the log messages which are coming from switch. so you can see from which switch the messages are getting repeated.

You can not disable the "last messages repeated <#> times".
Photo of David Wilkinson

David Wilkinson

  • 90 Points 75 badge 2x thumb
That is part of the problem, I can see the switch IP for every message apart from the "last message repeated" ones.

All I know is that something repeated somewhere but not which device.
Photo of Sumit Tokle

Sumit Tokle, Alum

  • 5,738 Points 5k badge 2x thumb
What is the switch model and software version?
Photo of David Wilkinson

David Wilkinson

  • 90 Points 75 badge 2x thumb
Extreme X480 and Extreme X670 running ExtremeXOS version 15.4.1.3 v1541b3-patch1-9
Photo of Sumit Tokle

Sumit Tokle, Alum

  • 5,738 Points 5k badge 2x thumb
Report this issue to TAC. It could be software issue.