Enable full message logging to be sure, but it looks like the Cisco isn't sending its host or IP in the message. I have this same problem with some cheap APs that have no way to identify them based on the syslog message.
You may have the option to configure the syslog service to send the IP or hostname however. See if this helps: https://supportforums.cisco.com/discussion/11432936/asa-syslog-shows-hostname-need-ip On Friday, September 9, 2016 at 6:53:28 AM UTC-4, Ahmed Alzaeem wrote: > > Hi guys > > > i already tried grayling 1.2 and 1.3 and both has the same result > > when i use cisco router or switch and send logs to the server ... the > logs are ok > but only the source ip is a bad string > > not sure how to correct it to be shown as the ip of the cisco sender > > here is a print screen for what I'm meaning > > hope to help me > > my kind regards > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/9b3ac964-c1b2-4f43-bb1e-2fb8b3e749ef%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
