https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40400#M5025 <BR /> Logging from syslog:<BR /> <BR /> How come ther is a difference in format ??<BR /> <BR /> EWC:<BR /> <BR /> &lt;6&gt;Jul 27 15:25:19 10.2.112.3(10.2.112.3) events: Radius Client Radius Response: Accepted: UserID:48:43:7C:2A:DB:3C, Client MAC:[48:43:7C:2A:DB:3C] 3<BR /> &lt;6&gt;Jul 27 15:25:19 10.2.112.3(10.2.112.3) events: Radius Client RADIUS server authenticated login (Access Accepted). 3<BR /> &lt;6&gt;Jul 27 15:25:19 10.2.112.3(10.2.112.3) dhcpd: DHCPREQUEST for 10.254.16.11 from 48:43:7c:2a:db:3c via csi6<BR /> <BR /> Switch: (firm. 16.1.2.14)<BR /> <BR /> &lt;5&gt;Jul 27 15:25:55 27-07-2018(10.2.112.209) 15:21:31 vlan.ms[1476]: Port 5 link down<BR /> &lt;5&gt;Jul 27 15:26:24 27-07-2018(10.2.112.209) 15:22:01 vlan.ms[1476]: Port 5 link down<BR /> &lt;5&gt;Jul 27 15:26:36 27-07-2018(10.2.112.209) 15:22:12 vlan.ms[1476]: Port 5 link down<BR /> <BR /> Thu, 26 Jul 2018 17:31:00 GMT JohanHendrikx 2018-07-26T17:31:00Z https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40393#M5018 I have configured my switch to send messages to the syslog server (XMC).<BR /> <BR /> configure syslog add <I>:514 vr VR-Default local0<BR /> configure log target syslog <I>:514 vr VR-Default local0 from <I><BR /> enable log target syslog <I>:514 vr VR-Default local0<BR /> configure log target syslog <I>:514 vr VR-Default local0 filter DefaultFilter severity Info<BR /> configure log target syslog <I>:514 vr VR-Default local0 match Any<BR /> configure log target syslog <I>:514 vr VR-Default local0 format timestamp seconds date dd-mm-yyyy event-name none tag-id tag-name<BR /> <BR /> The information I see in syslog is see screencopy<BR /> <BR /> <P class="fancybox-image"><span class="lia-inline-image-display-wrapper" image-alt="67fab2e854eb4ccb941f76e43c7aa892_RackMultipart20180726-24221-1yvi674-info_syslog_niet_right_inline.jpg"><img src="https://community.extremenetworks.com/t5/image/serverpage/image-id/3130iE646AE0FBA1E5BBA/image-size/large?v=v2&amp;px=999" role="button" title="67fab2e854eb4ccb941f76e43c7aa892_RackMultipart20180726-24221-1yvi674-info_syslog_niet_right_inline.jpg" alt="67fab2e854eb4ccb941f76e43c7aa892_RackMultipart20180726-24221-1yvi674-info_syslog_niet_right_inline.jpg" /></span></P><BR /> <BR /> I see the wrong info at source , client an the information isn't right (starts with minutes and seconds). <BR /> <BR /> </I></I></I></I></I></I></I> Thu, 26 Jul 2018 12:51:00 GMT https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40393#M5018 JohanHendrikx 2018-07-26T12:51:00Z https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40394#M5019 Hi. I guess you migrated from windows to linux or Virtual machine or opposite or simillar. The log file where the text syslog is present is parsed based on configured setting = xmc does expect some format. You can change the parsing . If you go to OneView -&gt; Alarms &amp; Events ~&gt; the last tab (if I remember well Log Manager) -&gt; then you need to find syslog and edit the format. Regards Z. Thu, 26 Jul 2018 17:31:00 GMT https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40394#M5019 Zdeněk_Pala 2018-07-26T17:31:00Z https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40395#M5020 Pala,<BR /> <BR /> I did a migration from windows to Linux. <BR /> <BR /> I cann;t change the format of the evnet patterns.<BR /> <BR /> Do I can change the logmangers. I noticed that the output is linked to the Red Hat Linux syslog pattern.<BR /> <BR /> When I choice Netsigth syslog pattern, there is no change.<BR /> <BR /> Thu, 26 Jul 2018 17:31:00 GMT https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40395#M5020 JohanHendrikx 2018-07-26T17:31:00Z https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40396#M5021 Not sure if NetSight is the right setting for your deployment. It may be Ubuntu. I am not sure if restart is required. Thu, 26 Jul 2018 17:31:00 GMT https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40396#M5021 Zdeněk_Pala 2018-07-26T17:31:00Z https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40397#M5022 nop. did not help for the syslog messages that XMC receive from switches. Thu, 26 Jul 2018 17:31:00 GMT https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40397#M5022 JohanHendrikx 2018-07-26T17:31:00Z https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40398#M5023 Is the issue present also for new messages comming? Do you have kind of syslog proxy/forward between your switch and XMC? Thu, 26 Jul 2018 17:31:00 GMT https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40398#M5023 Zdeněk_Pala 2018-07-26T17:31:00Z https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40399#M5024 We just finished changing hardware to G2 switches and I ve migrate XMC from windows to an apliance.<BR /> <BR /> Firmware is 22.4.1.4<BR /> .<BR /> I don't use a syslog proxy<BR /> <BR /> Messages from EWC looks oke<P class="fancybox-image"><span class="lia-inline-image-display-wrapper" image-alt="c233416c25e146628261acd6f50fa80c_RackMultipart20180727-71312-da25ji-info_syslog_niet_right2_inline.jpg"><img src="https://community.extremenetworks.com/t5/image/serverpage/image-id/3453i830E842D5C1FC365/image-size/large?v=v2&amp;px=999" role="button" title="c233416c25e146628261acd6f50fa80c_RackMultipart20180727-71312-da25ji-info_syslog_niet_right2_inline.jpg" alt="c233416c25e146628261acd6f50fa80c_RackMultipart20180727-71312-da25ji-info_syslog_niet_right2_inline.jpg" /></span></P> Thu, 26 Jul 2018 17:31:00 GMT https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40399#M5024 JohanHendrikx 2018-07-26T17:31:00Z https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40400#M5025 <BR /> Logging from syslog:<BR /> <BR /> How come ther is a difference in format ??<BR /> <BR /> EWC:<BR /> <BR /> &lt;6&gt;Jul 27 15:25:19 10.2.112.3(10.2.112.3) events: Radius Client Radius Response: Accepted: UserID:48:43:7C:2A:DB:3C, Client MAC:[48:43:7C:2A:DB:3C] 3<BR /> &lt;6&gt;Jul 27 15:25:19 10.2.112.3(10.2.112.3) events: Radius Client RADIUS server authenticated login (Access Accepted). 3<BR /> &lt;6&gt;Jul 27 15:25:19 10.2.112.3(10.2.112.3) dhcpd: DHCPREQUEST for 10.254.16.11 from 48:43:7c:2a:db:3c via csi6<BR /> <BR /> Switch: (firm. 16.1.2.14)<BR /> <BR /> &lt;5&gt;Jul 27 15:25:55 27-07-2018(10.2.112.209) 15:21:31 vlan.ms[1476]: Port 5 link down<BR /> &lt;5&gt;Jul 27 15:26:24 27-07-2018(10.2.112.209) 15:22:01 vlan.ms[1476]: Port 5 link down<BR /> &lt;5&gt;Jul 27 15:26:36 27-07-2018(10.2.112.209) 15:22:12 vlan.ms[1476]: Port 5 link down<BR /> <BR /> Thu, 26 Jul 2018 17:31:00 GMT https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40400#M5025 JohanHendrikx 2018-07-26T17:31:00Z https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40401#M5026 <BR /> I noticed that when you change the syntax the output is different.<BR /> <BR /> configure log target syslog 10.2.112.1:514 vr VR-Default local0 format timestamp seconds date none event-name none tag-id tag-name.<BR /> <BR /> &lt;5&gt;Jul 30 08:22:56 10.2.128.250(10.2.128.250) 08:18:30 vlan.ms[1933]: Port 3 link down<BR /> <BR /> What is the right syntax Thu, 26 Jul 2018 17:31:00 GMT https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40401#M5026 JohanHendrikx 2018-07-26T17:31:00Z https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40402#M5027 <BR /> <P class="fancybox-image"><span class="lia-inline-image-display-wrapper" image-alt="1b37fcfcb8214c2a9738011c256ce48a_RackMultipart20181018-81629-1max16l-syslog_message_inline.jpg"><img src="https://community.extremenetworks.com/t5/image/serverpage/image-id/1524i376604024AF03D10/image-size/large?v=v2&amp;px=999" role="button" title="1b37fcfcb8214c2a9738011c256ce48a_RackMultipart20181018-81629-1max16l-syslog_message_inline.jpg" alt="1b37fcfcb8214c2a9738011c256ce48a_RackMultipart20181018-81629-1max16l-syslog_message_inline.jpg" /></span></P> Thu, 18 Oct 2018 15:46:00 GMT https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40402#M5027 JohanHendrikx 2018-10-18T15:46:00Z https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40403#M5028 The syslog information is still not correct. I've change the syslogmanager in XMC to Red HAT Linux syslog pattern with no luck.<BR /> <BR /> Who has the answer?<BR /> Thu, 18 Oct 2018 15:46:00 GMT https://community.extremenetworks.com/t5/extremecloud-iq-site-engine/syslog-display-wrong-information/m-p/40403#M5028 JohanHendrikx 2018-10-18T15:46:00Z