LogZilla

Overview

LogZilla app for Dell EMC Networking N-Series switches running DNOS 6.x firmware. Covers N1100-ON, N1500, N2000, N2200, N3000, N3200, and N4000 series. Parses both the DNOS native (FASTPATH) log format and the Cisco IOS-compatible format that Dell N-Series switches emit for link, STP, LLDP, and port events.

App Function

Parses Dell N-Series switch logs and extracts:

Interface state changes (link up/down, line protocol up/down)
Spanning Tree topology changes and BPDU errors
LLDP neighbor discovery events
FDB MAC address movement events
Port error frame notifications
OSPF routing protocol errors
SupportAssist connection events

Provides per-Event-Class dashboards for network and system monitoring, plus triggers for interface flapping, STP storms, MAC move storms, and OSPF failures.

Vendor Documentation

Prerequisites

LogZilla Dedicated Port

Dell N-Series switches emit Cisco IOS-format syslog messages (%LINK-3-UPDOWN, %SPANTREE-5-TOPOTRAP, etc.) that are indistinguishable from actual Cisco devices. A dedicated port is required to route these events to the Dell parser instead of the Cisco parser.

Navigate to Settings > System > Application Ports
Set Dell N-Series syslog port to a dedicated port (e.g., 5523)
Click Save

Both TCP and UDP listeners are enabled on the configured port.

LogZilla Cloud: the Application Ports page is not available on the cloud platform, where devices reach LogZilla through a relay rather than a direct syslog listener. To enable parsing there, tag Dell N-Series events at the relay with _source_type=dell_n_series. See Application Ports on LogZilla Cloud.

Dell Switch Configuration

Configure each Dell N-Series switch to send syslog to the dedicated port:

Access the switch CLI via console or SSH
Enter configuration mode:

text
enable
configure

Configure syslog server with the dedicated port:

text
logging host <LogZilla-IP> port 5523
logging buffered informational

Save configuration:

text
write memory

Verification

Generate a link event by toggling an interface, then verify events appear in LogZilla with Vendor tag set to Dell.

Incoming Log Format

Dell N-Series switches generate syslog in two formats.

DNOS Native Format (FASTPATH)

text
taskName]: source_file.c(line) seqnum %% SEVERITY MESSAGE_TYPE: details

Cisco IOS-Compatible Format

text
 *Mon DD HH:MM:SS: %FACILITY-SEV-MNEMONIC: message

Parsed Metadata Fields

Tag Name	Example	Description
`Vendor`	`Dell`	Device vendor
`Product`	`N-Series Switch`	Product line
`Event Class`	`Network`, `System`	Event classification
`Event Type`	`Interface`, `Topology`, `Routing`, `Service`	Event type
`Interface`	`GigabitEthernet 1/0`	Network interface name (HC)
`VLAN`	`Vlan200`	VLAN identifier
`Action`	`Up`, `Down`, `MAC Move`, `Topology Change`	Event action
`SrcMAC`	`00:00:5e:00:53:01`	Source MAC address (HC)
`MitreId`	`T1557`	MITRE ATT&CK technique
`Dell Mnemonic`	`LINK-3-UPDOWN`	Facility-severity-mnemonic
`Dell MAC Move`	`Te2/0/27 -> Te2/0/28`	MAC move port path (HC)
`Dell STP Error`	`Invalid Forward Delay`	STP error description

Log Examples

FDB MAC Move (DNOS)

text
dtlAddrTask]: fdb.c(685) 981153 %% INFO MAC_MOVE: Mac 00:00:5e:00:53:01 in VLAN: 200 is overwritten from entryType 1 to 1 and port Te2/0/27 to Te2/0/28

STP BPDU Error (DNOS)

text
hapiRxTask]: dot1s_txrx.c(1236) 54878005 %% NOTE dot1sBpduReceive(): Invalid Forward Delay.

Interface Down (Cisco IOS)

text
 *Mar  6 14:22:50: %LINK-3-UPDOWN: Interface GigabitEthernet 1/0, changed state to down.

Topology Change (Cisco IOS)

text
 *Mar  6 15:01:22: %SPANTREE-5-TOPOTRAP: Topology Change Trap.

LLDP Neighbor (Cisco IOS)

text
 *Mar  6 15:10:05: %LLDP-5-CREATEREM: Port GigabitEthernet 1/28 created one new neighbor, Chassis ID is MikroTik1, Port ID is ether1.

OSPF Error (DNOS Short)

text
OSPF4-3: % [_ospf_snmp_ext_process_entry_read] Get ospf proc failed

Dashboards

Dell N-Series Network

Interface up/down event tracking
STP topology change monitoring
MAC move path distribution
OSPF routing error tracking
VLAN activity distribution
Top switches by event volume

Dell N-Series System

SupportAssist connection monitoring
System event timeline
Top switches by system event volume

Triggers

Dell N-Series Interface Down

Alerts when switch interfaces go down. Throttled per interface.

Dell N-Series STP Topology Storm

Alerts on excessive STP events indicating potential network loop.

Dell N-Series MAC Move Storm

Alerts on excessive MAC moves indicating potential AiTM attack or misconfiguration. Maps to MITRE T1557.

Dell N-Series OSPF Error

Alerts on OSPF routing protocol failures. Throttled per switch.