Hi Seba, I think I now understand. The problem is that Cisco devices don't send valid syslog (at least not according to the respective RFCs) and thus the Graylog syslog parser fails to parse them correctly. You'll need to use a Raw/Plaintext input for those devices and create some extractors to get the information you want: http://docs.graylog.org/en/2.0/pages/extractors.html
Cheers, Jochen On Wednesday, 11 May 2016 16:34:02 UTC+2, Seba wrote: > > Hi Jochen > > I cannot create exceptions alerts via email, because in the messages, that > I get from the Cisco switch there is no source IP. > > This is a user's access to the Cisco switch: > 23] at 09:20:08 CET Tue May 10 2016 > > *Thank you so much for your support* > > *Seba* > > On Friday, May 6, 2016 at 11:47:14 AM UTC+2, Seba wrote: >> >> *Dear all,* >> >> >> >> >> *How can I set a streaming rule, in order to not send a notification, >> when access to the switch is not coming from known IP’s? My Cisco Catalyst >> 3750X doesn’t add the source IP in the notification for logins, but it does >> when somebody modifies the settings.* >> >> >> >> *I have been trying to find a solution for the last few days without >> success. * >> >> >> >> *Thank you so much for your support* >> >> *Seba* >> > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/c0a8897c-293b-4510-8ca7-ac37da94796e%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
