I have Logwatch setup to monitor all RHEL servers in my environment.

In the last few days, where the Reporting on hosts is, it is showing the names of four network switches which are not RHEL in any, shape or form.

Not sure why this happened or what caused it. Was wondering if anyone had any idea on how to troubleshoot this?

thanks

Somewhere along the line there are DNS or host file entries that are out of sync with reality?

Logwatch as I understand it only scans your logs to report information.

You have to have a tool such as syslog (or syslog-ng or similar) to actually accept the logging connections from systems. Network switches and other devices can run syslogd and communicate with central logging servers. We have a setup here on one our Linux systems running syslog-ng specifically just to get logs from all of our network devices.

You'd have to determine what your central logging server is running then look at the configuration for that to see if you can restrict it to certain devices that do NOT include your switches. It is probably better to set it up to only include devices you do want rather than restricting those you not want.

Running rsyslog on all RHEL servers, which includes the logging server.

I checked /etc/hosts on that logging server and only RHEL systems and other servers that run services on that server have entries on it.

Not sure if there is way to restrict what is sent to rsyslog, will have to look into this.