Loading...

My Account

Log In

Knowledge Center

Get support for FireEye products

Events don't download for data sources using syslog-ng relay and host names with underscores

Technical Articles ID: KB94055
Last Modified: 2022-10-19 06:44:21 Etc/GMT

Environment

SIEM Event Receiver (Receiver) 11.x
SIEM Enterprise Security Manager 11.x

Problem

A data source is configured to use a syslog_ng relay and doesn't download any event data.

Cause

This issue occurs because of the following:

The use of underscores in host names isn't supported. (The form syslog_ng is incorrect. The correct form is syslog-ng.)
The original RFC standard for host names specifies that underscore isn't a valid character.
It can cause unpredictable behavior in the pulling and processing of event data in SIEM. Some might work, while others don't.

Solution

Use host names without underscores in them.

For example:

Use Cisco-ASA (without an underscore)
Don’t use Cisco_ASA (with an underscore)

Affected Products

Languages:

This article is available in the following languages: