Cisco Support Community

Syslog Message -- 6 octet src ip address

I am running the standard syslog facility for Solaris, collecting syslog info from Cisco routers.

Recently, we started seeing a bracketed, 6 octet string in place of some of some of the host names. The first 4 octets are an IP address from the router and the last 2 octets are consistent for each IP address, but I have no clue what they represent.

May 21 20:23:47 [] 51: May 21 20:26:52: %DUAL-5-NBRCHANGE: IP-EIGRP 10: Neighbor (Vlan60) is up: new adjacency

Any ideas on why am I getting bracketed IP's, what are the final 2 octets?

P.S. The router doesnot run IPv6.


Re: Syslog Message -- 6 octet src ip address

Syslogd logging 6 octets = 4 IP octets + 2 random octets is seen only on Solaris. In fact, it is a bug in solaris Bug ID: 4008705. This bug is closed with no status update from Sun. Here is the partial text of the bug:


The previous problem of syslog logging three question marks (???) instead of an IP address has been resolved (103291 fixed this) - but now syslog logs the IP address with two extra fields (at the end of address). Also shows the full hostname if using DNS - not the nickname. Here is the Solaris (patched with 103291-02) syslogd log file output:

Oct 10 07:55:38 [] 1103: Oct 10 08:54:15: %LINK-3-UPDOWN:

Interface Serial2/2, changed state to up

Oct 10 07:55:41 [] 1104: Oct 10 08:54:18: %LINK-3-UPDOWN: Interface Serial2/2, changed state to down

Oct 10 07:59:21 6476: %LANCE-5-COLL: Unit 1, excessive collisions. TDR=20



Re: Syslog Message -- 6 octet src ip address


Thanks so much for the information. Is there a way that I can view the bug description in sun website. Can you please provide me a link to the bug report page.




Re: Syslog Message -- 6 octet src ip address

You can view it via

CreatePlease to create content