Remote syslog server flooded with debug messages regardless of severity level selected in log settings

robert_nattoo — Mon, 14 May 2018 20:52:06 GMT

I set up a Splunk server to index syslog messages from a SmartZone 100. I enabled syslogs in the Smartzone Web GUI and immediately started getting about 5000 messages per minute. This continues even if I set the minimum severity level to critical.

Example message:

...sshd[26692]: debug1: connect_next: host localhost ([127.0.0.1]:514) in progress, fd=8

It seems like it's sending debug messages and ignoring the log severity setting in the GUI. I have also tried setting this in the CLI but there was no difference in behavior.

Has anyone had a similar experience? At the current rate, I will exhaust my Splunk license. I need to be able to filter out these debug messages.

Re: Remote syslog server flooded with debug messages regardless of severity level selected in log settings

ravi_teja_9zbkf — Tue, 15 May 2018 05:28:24 GMT

Hi Robert,

What version of software is running on SZ100 ?
We have come across this issues before and we do have KSP patch available to address this. Request you to log a ticket with Ruckus Support Team for the patch file.

Regards
Ravi Teja

topic Remote syslog server flooded with debug messages regardless of severity level selected in log settings in To Be Moved

Remote syslog server flooded with debug messages regardless of severity level selected in log settings

Re: Remote syslog server flooded with debug messages regardless of severity level selected in log settings