User source logging - Character string logged as source address

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-20-2016 05:44 AM - edited 03-08-2019 06:16 AM
Is there a know bug for this problem i have encountered?
in my logs the logging of users source address is showing up as the following
[Source: ?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{] [localport: 22]
- Labels:
-
Other Switching
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-20-2016 06:46 AM
Paul,
I am not entirely sure about your question. Are you saying that this is the message you are seeing in your logs? If so, can you please be more specific about your configuration, the device types, and the setup in particular?
Best regards,
Peter
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-20-2016 07:53 AM
Hi Peter,
I am seeing the message in the logs and the switch in particular is a 2960X
The configuration command used to produce message is 'login on-success log'
Message produced
'[Source: ?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{] [localport: 22]'
Source in this log message should show the ip address of the administrator rather than a large character string
Any ideas why this weird character string is being produced as the source?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-21-2016 01:55 AM
Hi Paul,
Somehow, I doubt that this string is sent by the 2960X. It looks more like this string is generated by the syslog server itself.
Can you run a packet capture (using Wireshark, for example) on the syslog server and capture the syslog messages sent by this 2960X? It would help us identify beyond doubt whether this strange string is indeed being sent from the switch.
Best regards,
Peter
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-21-2018 12:35 AM
I have the same message on a 2960-x swtich
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
04-30-2018 09:58 AM
Same issue here.
Have there been any updates regarding this issue?
example:
Apr 30 11:53:53.534 CT: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: admin] [Source: uvwxyz{|}~^@^A^B^C^D^E^F
^K^L^N^O^P^Q^R^S^T^U^V^W^X^Y^Z^[^\^]^^^_ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{] [localport: 22] [Reason: Login Authentication Failed] at 11:53:53 CT Mon Apr 30 2018
Thanks.
