Forum Discussion

Justin_Lanoue's avatar
Justin_Lanoue
Icon for Neophyte rankNeophyte
30 days ago

LogSource Resource Mapping Confusion

I have a ticket opened but hoping to get a quicker response here. I am using LogSources but since we are an MSP with multiple clients, there seems to be an issue syslog's are being mapped to other c...
LM Logs
  • Justin_Lanoue's avatar
    Justin_Lanoue
    29 days ago

    Yeah I know about that option which is what I was refencing in the opening and that doesn't work.

    I seem to have fixed this issue though with my own experimentation with the below settings.

    This got devices mapping properly with duplicate IP as seen below.

    It went from the wrong core switch to the proper Sophos XG device that shared the same IP.

     

    No clue how this works as if knows the deviceID the log is coming from why even have all this IP mapping shenanigans?

Stuart_Weenig's avatar
Stuart_Weenig
Icon for Mastermind rankMastermind
Justin_Lanoue wrote:

Am I doing something wrong or is the system not smart enough to know that it came on this collector, therefore I should only map it to resources monitored by that collector?

On purpose, it ignores the collector assignment. This is because you might want the logs coming in on one collector and the collection happening on a different collector, to distribute the load. 

FWIW: we don't use IP=system.hostname. Instead we use IP=system.ips. However, I can't be sure that one customer's logs aren't showing up under a different customer. Now I have to check and I'll be following for a solution. 

Justin_Lanoue's avatar
Justin_Lanoue
Icon for Neophyte rankNeophyte
30 days ago

FWIW: we don't use IP=system.hostname. Instead we use IP=system.ips. However, I can't be sure that one customer's logs aren't showing up under a different customer

I found using system.ips was way worse as it opened a broader scope to duplicate IPs.

On purpose, it ignores the collector assignment. This is because you might want the logs coming in on one collector and the collection happening on a different collector, to distribute the load. 

I understand but even then, there should be logic to know the collector and the device both have the system.tenant.identifier property or something.

I'll definitely update this thread if I get a solution from support.

  • Stuart_Weenig's avatar
    Stuart_Weenig
    Icon for Mastermind rankMastermind
    30 days ago

    On the device, you can check a box that says "Enable LM Logs" which will give you the ability to specify a collector group and collector. That may be how it's done.

    Now i gotta go figure out how to script it so that all devices have it checked and set to the collecting collector.

    • Justin_Lanoue's avatar
      Justin_Lanoue
      Icon for Neophyte rankNeophyte
      29 days ago

      Yeah I know about that option which is what I was refencing in the opening and that doesn't work.

      I seem to have fixed this issue though with my own experimentation with the below settings.

      This got devices mapping properly with duplicate IP as seen below.

      It went from the wrong core switch to the proper Sophos XG device that shared the same IP.

       

      No clue how this works as if knows the deviceID the log is coming from why even have all this IP mapping shenanigans?

      • Stuart_Weenig's avatar
        Stuart_Weenig
        Icon for Mastermind rankMastermind
        29 days ago

        Yeah, i have another thread somewhere talking about the completely illogical nature of the circular logic between appliesto of a logsource and the mapping. 

        FWIW: I'm about to roll out this script, which should make sure that every device in my portal has the log collector configured as the preferred collector. I could have set to be the current collector, but in a failover situation, the logs will still be going to the original collector. 

        from lm import lm

devices = []
end_found = False
offset = 0
size = 1000
while not end_found:
    current = lm.get_device_list(size=size,offset=offset).items
    devices += current
    offset += len(current)
    end_found = len(current) != size

for device in devices:
    collector_id = device.preferred_collector_id
    if (
        not device.is_preferred_log_collector_configured
        or not device.log_collector_id == collector_id
        or not device.current_log_collector_id == collector_id
    ):
        payload = {'isPreferredLogCollectorConfigured':True, 'logCollectorId':collector_id, 'currentLogCollectorId':collector_id}
        response = lm.patch_device(device.id, payload)
        if response: print(f"Configured log {collector_id} for {device.name}")
        else: print(f"There was an error: {response}")
    else: print(f"{device.name} is already correctly configured.")