Syslog lookup may select wrong device when IP exists in devices.ip and ipv4_addresses

Help
1

Hi,

I believe there may be a regression in the current syslog device lookup.

I have a setup where the same IP address exists in two places:

  • Device A has the IP as its primary devices.ip.
  • Device B has the same IP as an interface address in ipv4_addresses.

Device A is the actual syslog sender.

When a syslog message arrives from that IP, the current lookup can assign the message to Device B instead of Device A.

I traced this to the current lookup in LibreNMS/Syslog/Processor.php.

The query matches both:

devices.ip

and:

ipv4_addresses.ipv4_address

and then uses:

return $query->value('device_id');

There is no explicit precedence between an exact primary device IP match and an interface/secondary IP match.

In my case this results in the syslog entries being stored against the wrong device.

Expected behaviour would be that an exact match against devices.ip takes precedence over a match through ipv4_addresses.

This appears to be related to the syslog lookup changes introduced in commit 97c7cbba.

Has this behaviour been noticed before, or is there an intended precedence for these two types of IP matches?

I can provide a minimal reproduction/test case if useful.

2