User source logging - Character string logged as source address

[Paul Hanton]

Is there a know bug for this problem i have encountered?

in my logs the logging of users source address is showing up as the following

[Source: ?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{] [localport: 22]

[Peter Paluch]

Paul,

I am not entirely sure about your question. Are you saying that this is the message you are seeing in your logs? If so, can you please be more specific about your configuration, the device types, and the setup in particular?

Best regards,
Peter

[Paul Hanton]

Hi Peter,

I am seeing the message in the logs and the switch in particular is a 2960X

The configuration command used to produce message is 'login on-success log'

Message produced

'[Source: ?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{] [localport: 22]'

Source in this log message should show the ip address of the administrator rather than a large character string

Any ideas why this weird character string is being produced as the source?

[Peter Paluch]

Hi Paul,

Somehow, I doubt that this string is sent by the 2960X. It looks more like this string is generated by the syslog server itself.

Can you run a packet capture (using Wireshark, for example) on the syslog server and capture the syslog messages sent by this 2960X? It would help us identify beyond doubt whether this strange string is indeed being sent from the switch.

Best regards,
Peter

[libanhou]

I have the same message on a 2960-x swtich

[kbkendrick04]

Same issue here.

Have there been any updates regarding this issue?

example:

Apr 30 11:53:53.534 CT: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: admin] [Source: uvwxyz{|}~^@^A^B^C^D^E^F
^K^L^N^O^P^Q^R^S^T^U^V^W^X^Y^Z^[^\^]^^^_ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{] [localport: 22] [Reason: Login Authentication Failed] at 11:53:53 CT Mon Apr 30 2018

Thanks.