Syslog Message -- 6 octet src ip address

[pbarman]

I am running the standard syslog facility for Solaris, collecting syslog info from Cisco routers.

Recently, we started seeing a bracketed, 6 octet string in place of some of some of the host names. The first 4 octets are an IP address from the router and the last 2 octets are consistent for each IP address, but I have no clue what they represent.

May 21 20:23:47 [13.135.128.1.224.33] 51: May 21 20:26:52: %DUAL-5-NBRCHANGE: IP-EIGRP 10: Neighbor 13.135.60.1 (Vlan60) is up: new adjacency

Any ideas on why am I getting bracketed IP's, what are the final 2 octets?

P.S. The router doesnot run IPv6.

[rmushtaq]

Syslogd logging 6 octets = 4 IP octets + 2 random octets is seen only on Solaris. In fact, it is a bug in solaris Bug ID: 4008705. This bug is closed with no status update from Sun. Here is the partial text of the bug:

-----------------------------------------------------------------

The previous problem of syslog logging three question marks (???) instead of an IP address has been resolved (103291 fixed this) - but now syslog logs the IP address with two extra fields (at the end of address). Also shows the full hostname if using DNS - not the nickname. Here is the Solaris (patched with 103291-02) syslogd log file output:

Oct 10 07:55:38 [167.240.252.1.171.228] 1103: Oct 10 08:54:15: %LINK-3-UPDOWN:

Interface Serial2/2, changed state to up

Oct 10 07:55:41 [167.240.252.1.171.228] 1104: Oct 10 08:54:18: %LINK-3-UPDOWN: Interface Serial2/2, changed state to down

Oct 10 07:59:21 logan.state.mi.us 6476: %LANCE-5-COLL: Unit 1, excessive collisions. TDR=20

---

[pbarman]

Hi,

Thanks so much for the information. Is there a way that I can view the bug description in sun website. Can you please provide me a link to the bug report page.

Thanks,

Partha

[rmushtaq]

You can view it via http://sunsolve.sun.com