This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

wrong / missing hostname in syslog, bug ?

Hi there,
we are currently sending all XG logs to our SIEM via syslog.
We have to determine, that the actual hostname of the FW is not transmitted correctly.

<30>device="SFW" date=2020-05-18 time=14:38:57 timezone="CEST" device_name="XG230" device_id=1234567890123456

The correct firewall hostname is not contained in either "device" or "device_name".
Should that be so or a bug ?

regards
StefanS

This thread was automatically locked due to age.

Parents

0 emmosophos over 5 years ago

Hello StefanS,

I confirmed and yes this is expected.

It only sends the Model number.

Regards,
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 emmosophos over 5 years ago

Hello StefanS,

I confirmed and yes this is expected.

It only sends the Model number.

Regards,
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 StefanS over 5 years ago in reply to emmosophos

i already suspected that Sophos again does not adhere to any standard.
Several other firewall manufacturers and i know quite a few, send the syslog_hostname in the device_name field "not" the model number.
For the flow inspection in a SIEM, the model number is "not" relevant, but the host name / observer name.
Cancel
Vote Up 0 Vote Down

Cancel
0 Michael Dunn over 5 years ago in reply to StefanS

StefanS said:

i already suspected that Sophos again does not adhere to any standard.

It is not uncommon for systems that write syslog not to include hostname. The syslog server figures it out itself.

https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-guide/keep-hostname#:~:text=If%20the%20log%20message%20does,was%20transferred%20via%20a%20relay).
Cancel
Vote Up 0 Vote Down

Cancel