Modify Cisco 9130 Syslog Message Format on 9800 WLC

[herophil322]

Hello everyone,
I have rather specific question about syslog on 9130 aps. I would like to activate syslog on the access points. We have a Redhat Rsyslog, and my colleague mentioned he's having some difficulties, if the syslog string doesn't include the IP of the device.

A syslog messages looks like the following:

2024-04-02T12:59:13.877039+02:00 Apr 2 DEVICEHOSTNAME 10:59:13 kernel: [*04/02/2024

On the APs, only the hostname is provided. Is it possible to centrally adjust the syslog format for the APs, so the ip is included or just the ip is used instead of the hostname? Do you guys happen to know anything about this?

Kind Regards
Phil

[marce1000 · Accepted solution]

  - It can't be done , because its fixed behavior in IOS-XE , from the controller viewpoint it only wants to report something about a known or registered AP,

 M.

[Rich R]

Remember the syslog entry always includes the source IP address of the device which sent the syslog by default (unless you've customised the logging format to remove the source IP) - regardless of what hostname is sent by the device, so your colleague just needs to use the source IP address instead of the hostname.

Some examples at https://serverfault.com/questions/400293/syslog-ip-ranges-to-specific-files-using-rsyslog