syslog server question

LinuxLover · 05-11-2010, 08:48 AM

Hi all,

I am using all solaris 10 machines. and configure a syslog server.all client machine send their logs to this server.

I am facing one trivail problem in this setup.syslog server add two extra digits with each client machine ip while adding entry in log files like

Code:

May 11 18:14:07 [192.168.150.110.128.12] su: [ID 810491 auth.crit] 'su root' failed for ktahir on /dev/pts/1
May 11 18:14:17 [192.168.150.110.128.12] su: [ID 366847 auth.notice] 'su root' succeeded for ktahir on /dev/pts/1

Here client ip is 192.168.150.110 but in syslog server file it is displyaing 192.168.150.110.128.12. How can I trim these two extra digits and why are these here?

jlliagre · 05-11-2010, 07:38 PM

Usually, when trailing numbers appear after an IP address, they represent a port number. I don't know if that might be the case here as I believe both 512 are used as src and destination ports with syslog.

What happens if that IP address is resolvable (through /etc/hosts, the DNS or whatever name service you might use) ?