Skip to main content

Mon, May 14, 2018 8:52 PM

Remote syslog server flooded with debug messages regardless of severity level selected in log settings

I set up a Splunk server to index syslog messages from a SmartZone 100. I enabled syslogs in the Smartzone Web GUI and immediately started getting about 5000 messages per minute.  This continues even if I set the minimum severity level to critical.  

Example message:
...sshd[26692]: debug1: connect_next: host localhost ([127.0.0.1]:514) in progress, fd=8
It seems like it's sending debug messages and ignoring the log severity setting in the GUI.  I have also tried setting this in the CLI but there was no difference in behavior.

Has anyone had a similar experience?  At the current rate, I will exhaust my Splunk license.  I need to be able to filter out these debug messages.   

Responses

11 Messages

 • 

174 Points

3 years ago

Hi Robert,

What version of software is running on SZ100 ?
We have come across this issues before and we do have KSP patch available to address this. Request you to log a ticket with Ruckus Support Team for the patch file.

Regards
Ravi Teja