I run a PIX520 V6.1(1).
I have installed PIX FW syslog server PFSS on WinNT4.
I get syslog records there, but I cannot see the hostname of the originating PIX in the syslog records. I only get messages with some strange <nnn> numbers at the beginning (f.e.):
<163>Mar 19 2002 09:47:51: %PIX-3-307001: Denied Telnet login session from 10.62.144.30 on interface inside
<162>Mar 19 2002 09:54:12: %PIX-2-109011: Authen Session Start: user '', sid 5
<162>Mar 19 2002 10:19:09: %PIX-2-109011: Authen Session Start: user '', sid 6
<162>Mar 19 2002 10:38:33: %PIX-2-109011: Authen Session Start: user '', sid 7
<162>Mar 19 2002 10:54:07: %PIX-2-109011: Authen Session Start: user '', sid 8
<162>Mar 19 2002 11:06:04: %PIX-2-109011: Authen Session Start: user '', sid 9
<163>Mar 19 2002 11:40:07: %PIX-3-307001: Denied Telnet login session from 10.62.144.30 on interface inside
Why are no hostnames displayed. If I send the same syslog records to a Solaris syslogd I can see the hostname (it looks like they are reverse resolved from the DNS-Server there). The WinNT uses the same DNS-server.
Who has an idea?
