Syslog Originators

A syslog originator is the device, server, or application that first generates a syslog message — not a relay or proxy that only forwards it.

Each originator is stored as a record with:

  • ID — immutable key used by the collector, filters, and reports (usually the sender IP address)

  • Name — label shown in Manager

  • Parser — how stored messages from this originator are broken into fields

  • Groups — optional originator groups used by filters

  • Active — whether the collector still accepts messages from this ID

Originators live in syslog storage. The collector creates them when a new ID arrives (when that is allowed). Manager edits the list, properties, and groups.

In Syslog Watcher 5 and earlier, the same entity was called a syslog source.

How Originators Are Registered

The collector assigns an originator ID to every incoming message, then looks that ID up in storage.

When the ID is already registered and Active is Yes, the message is stored against that originator. When the ID is already registered and Active is No, the message is discarded.

When the ID is new, If originator ID is unknown decides what happens:

  • Add new originator (usual case) — the collector inserts a storage record and keeps the message

  • Discard messages — the message is dropped; nothing is added to the list

Automatic adding uses the default parser for the new record. The Name is a reverse-DNS result when Resolve name (reverse DNS lookup) is Yes and the ID came from the sender IP address. Otherwise the name is the same string as the ID.

New Active originators count toward the license originator limit. When the limit is reached, messages from further unknown IDs are discarded.
For relays, proxies, or dynamic addresses, set Originator ID Rules on the collector.

Syslog Originators Window

The Syslog Originators window lists every registered originator.

Columns:

Column Description

Active

Yes (accepts messages) or No (messages from this ID are discarded).

ID

Originator ID assigned at registration.

Name

Display name.

Parser

Parser used for this originator’s messages. \<unknown parser\> means the assigned parser is missing from storage.

Groups

Groups that include this originator, separated by ;.

Description

Optional comment from the originator editor.

The header row filters the list (Active, and text on the other columns).

Without permission to change originators, the window is Read Only (Edit…​ becomes View…​).

Add an Originator

Manual add is for pre-registering an ID, or when If originator ID is unknown is Discard messages. When Add new originator is on, the collector creates the record on the first message.

  1. Click Add…​.

  2. If automatic adding is on, confirm that a manual record is still required.

  3. Fill Originator Properties.

  4. Click Create.

ID and Name are required. ID must be unique.

Edit Originators

Select one or more rows and click Edit…​ (or View…​ in Read Only).

One row opens the full property set. Several rows open the common properties only: Active, Parser, and Groups. Values that differ across the selection show as \<different states\> or \<different parsers\> and stay unchanged unless replaced.

Delete Originators

Select one or more rows → Delete → confirm.

Deletion is irreversible. The originator is removed from every group. Stored messages that already reference it stay in storage.

Prefer turning Active off when the ID should stop sending into storage but the record should remain.

Originator Properties

Setting Description

Active

Yes accepts new messages for this ID. No discards them. Inactive originators do not count toward the license limit.

ID

Unique identifier. Required on create; read-only after that.

Name

Required label shown in Manager and in filters.

Description

Optional comment (under Name).

Parser

Parser applied to this originator’s stored messages. New originators get the default parser. A name prefixed with Installation: is a parser from the product install; confirming copies it into storage and assigns that copy.

Groups

Membership in existing originator groups. An originator can belong to more than one group.

Inactive Originators

Set Active to No to stop collection for that ID without deleting the record.

The collector treats an inactive ID as known-but-rejected: messages are discarded, and the license slot is freed.

Related Topics