Forum Discussion

Justin_Lanoue's avatar
Justin_Lanoue
Icon for Neophyte rankNeophyte
4 months ago

LogSource Resource Mapping Confusion

I have a ticket opened but hoping to get a quicker response here. I am using LogSources but since we are an MSP with multiple clients, there seems to be an issue syslog's are being mapped to other c...
LM Logs
  • Justin_Lanoue's avatar
    Justin_Lanoue
    3 months ago

    Yeah I know about that option which is what I was refencing in the opening and that doesn't work.

    I seem to have fixed this issue though with my own experimentation with the below settings.

    This got devices mapping properly with duplicate IP as seen below.

    It went from the wrong core switch to the proper Sophos XG device that shared the same IP.

     

    No clue how this works as if knows the deviceID the log is coming from why even have all this IP mapping shenanigans?

Justin_Lanoue's avatar
Justin_Lanoue
Icon for Neophyte rankNeophyte

FWIW: we don't use IP=system.hostname. Instead we use IP=system.ips. However, I can't be sure that one customer's logs aren't showing up under a different customer

I found using system.ips was way worse as it opened a broader scope to duplicate IPs.

On purpose, it ignores the collector assignment. This is because you might want the logs coming in on one collector and the collection happening on a different collector, to distribute the load. 

I understand but even then, there should be logic to know the collector and the device both have the system.tenant.identifier property or something.

I'll definitely update this thread if I get a solution from support.

Anonymous's avatar
Anonymous
4 months ago

On the device, you can check a box that says "Enable LM Logs" which will give you the ability to specify a collector group and collector. That may be how it's done.

Now i gotta go figure out how to script it so that all devices have it checked and set to the collecting collector.

  • Justin_Lanoue's avatar
    Justin_Lanoue
    Icon for Neophyte rankNeophyte
    3 months ago

    Yeah I know about that option which is what I was refencing in the opening and that doesn't work.

    I seem to have fixed this issue though with my own experimentation with the below settings.

    This got devices mapping properly with duplicate IP as seen below.

    It went from the wrong core switch to the proper Sophos XG device that shared the same IP.

     

    No clue how this works as if knows the deviceID the log is coming from why even have all this IP mapping shenanigans?

    • Anonymous's avatar
      Anonymous
      3 months ago

      Yeah, i have another thread somewhere talking about the completely illogical nature of the circular logic between appliesto of a logsource and the mapping. 

      FWIW: I'm about to roll out this script, which should make sure that every device in my portal has the log collector configured as the preferred collector. I could have set to be the current collector, but in a failover situation, the logs will still be going to the original collector. 

      from lm import lm

devices = []
end_found = False
offset = 0
size = 1000
while not end_found:
    current = lm.get_device_list(size=size,offset=offset).items
    devices += current
    offset += len(current)
    end_found = len(current) != size

for device in devices:
    collector_id = device.preferred_collector_id
    if (
        not device.is_preferred_log_collector_configured
        or not device.log_collector_id == collector_id
        or not device.current_log_collector_id == collector_id
    ):
        payload = {'isPreferredLogCollectorConfigured':True, 'logCollectorId':collector_id, 'currentLogCollectorId':collector_id}
        response = lm.patch_device(device.id, payload)
        if response: print(f"Configured log {collector_id} for {device.name}")
        else: print(f"There was an error: {response}")
    else: print(f"{device.name} is already correctly configured.")

       

      • Justin_Lanoue's avatar
        Justin_Lanoue
        Icon for Neophyte rankNeophyte
        3 months ago

        Just tested and it completely works with just the deviceID mapping...

         

        That baffles me as the default LogSource LM provides you is this config below which make it seem like even they don't know how it works.