LI82006: ANALYTICS SYSLOG LOGSTASH PLUGIN NOT SETTING FACILITY CORRECTLY

APAR status

• Closed as documentation error.

Error description

• Analytics syslog offload facility not setting correctly.
  Logstash is used to configure data offload to Syslog for
  Analytics. There's an issue#39 of
  logstash-output-syslog.
  Facility level is different between
  configured the facility level on analytics and the facility
  level of legevent recieved on syslog server.
  

Local fix

• Set different value in logstash offload config to get the right
  value sent to offload server
  

Problem summary

• There is a mismatch in configured syslog facility values versus
  runtime / offload syslog facility values when configuring
  analytics syslog offload.  The values that are mismatched are
  iin the higher range of possibly syslog facility values.
  

Problem conclusion

• A documentation change was made to inform customers of this
  mismatch.  See local workaround for steps to get the right
  value.  No product change is coming to fix this.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels