LogSource Resource Mapping Confusion

I have a ticket opened but hoping to get a quicker response here.

I am using LogSources but since we are an MSP with multiple clients, there seems to be an issue syslog's are being mapped to other client devices that have the same IP because I'm using IP=system.hostname as the mapping.

I have even pointed all the duplicate IPs to their respective syslog collector and it still maps wrong.

Am I doing something wrong or is the system not smart enough to know that it came on this collector, therefore I should only map it to resources monitored by that collector?

Is there a way I can use AND logic with the Token mapping for _lm.collectorId = system.collectorid?

Thanks in advance.

Justin Lanoue

Posted 1 year ago·Last reply 1 year ago

6 comments

LM User

·1 year ago

Justin_Lanoue wrote:
Am I doing something wrong or is the system not smart enough to know that it came on this collector, therefore I should only map it to resources monitored by that collector?

On purpose, it ignores the collector assignment. This is because you might want the logs coming in on one collector and the collection happening on a different collector, to distribute the load.

FWIW: we don't use IP=system.hostname. Instead we use IP=system.ips. However, I can't be sure that one customer's logs aren't showing up under a different customer. Now I have to check and I'll be following for a solution.

Justin Lanoue

OP1 year ago

FWIW: we don't use IP=system.hostname. Instead we use IP=system.ips. However, I can't be sure that one customer's logs aren't showing up under a different customer

I found using system.ips was way worse as it opened a broader scope to duplicate IPs.

On purpose, it ignores the collector assignment. This is because you might want the logs coming in on one collector and the collection happening on a different collector, to distribute the load.

I understand but even then, there should be logic to know the collector and the device both have the system.tenant.identifier property or something.

I'll definitely update this thread if I get a solution from support.

LM User

·1 year ago

On the device, you can check a box that says "Enable LM Logs" which will give you the ability to specify a collector group and collector. That may be how it's done.

Now i gotta go figure out how to script it so that all devices have it checked and set to the collecting collector.

Justin Lanoue

OP1 year ago

Yeah I know about that option which is what I was refencing in the opening and that doesn't work.

I seem to have fixed this issue though with my own experimentation with the below settings.

This got devices mapping properly with duplicate IP as seen below.

It went from the wrong core switch to the proper Sophos XG device that shared the same IP.

No clue how this works as if knows the deviceID the log is coming from why even have all this IP mapping shenanigans?

LM User

·1 year ago

Yeah, i have another thread somewhere talking about the completely illogical nature of the circular logic between appliesto of a logsource and the mapping.

FWIW: I'm about to roll out this script, which should make sure that every device in my portal has the log collector configured as the preferred collector. I could have set to be the current collector, but in a failover situation, the logs will still be going to the original collector.

from lm import lm

devices = []
end_found = False
offset = 0
size = 1000
while not end_found:
    current = lm.get_device_list(size=size,offset=offset).items
    devices += current
    offset += len(current)
    end_found = len(current) != size

for device in devices:
    collector_id = device.preferred_collector_id
    if (
        not device.is_preferred_log_collector_configured
        or not device.log_collector_id == collector_id
        or not device.current_log_collector_id == collector_id
    ):
        payload = {'isPreferredLogCollectorConfigured':True, 'logCollectorId':collector_id, 'currentLogCollectorId':collector_id}
        response = lm.patch_device(device.id, payload)
        if response: print(f"Configured log {collector_id} for {device.name}")
        else: print(f"There was an error: {response}")
    else: print(f"{device.name} is already correctly configured.")

Justin Lanoue

OP1 year ago

Just tested and it completely works with just the deviceID mapping...

That baffles me as the default LogSource LM provides you is this config below which make it seem like even they don't know how it works.