Overview
ExtremeCloud IQ - Site Engine (XIQ-SE) is the current name of Extreme Management Center, formerly known as NetSight. Site Engine can forward its own alarms and the ExtremeXOS EMS events it receives from managed switches to a syslog server. This article explains how to collect those messages in Logsign Unified SecOps Platform with the Extreme / Management Center parser.
Messages forwarded by Site Engine have a different header from messages sent directly by a switch, for example:
2026/10/08T09:38:35.514CEST NetSight ExtremeCloud IQ - Site Engine: Device Severity Info Message: <nl.ClientAuthenticated> Network Login MAC user ...Select Management Center as the product for this source, even if the events originate from X Series or other ExtremeXOS switches. The X Series Switch parser does not recognize the Site Engine header, so these messages stay unparsed if the source is added with that product. If your switches send syslog directly to Logsign instead, see Adding Extreme Network Switch via Syslog.
Prerequisites
- Administrative access to ExtremeCloud IQ - Site Engine.
- Network connectivity from the Site Engine server to the Logsign USO collector on your syslog port (TCP or UDP 514 by default).
- Support for the Site Engine message format requires a Logsign release that includes the updated Management Center parser. Older releases parse only the classic NetSight format. Contact Logsign Support if you are not sure which release you run.
Configuring Syslog Forwarding on Site Engine
In Site Engine, add the Logsign collector as a syslog destination and point the alarm and event forwarding actions you want to collect at it. Use the IP address of the Logsign collector and the syslog port and protocol that match the listener on the Logsign side. The exact menu location differs between Site Engine versions, so follow Extreme's Site Engine documentation for your version.
Site Engine sends the messages from its own server. Logsign therefore sees the Site Engine server IP address as the event source, not the IP address of each switch.
Adding the Source in Logsign
- Open the Logsign Unified SecOps Platform web interface and go to Settings > Data Collection.
- Click + Device.
- On the Source Type Selection page, choose Syslog as the method.
- Select Extreme as the vendor and Management Center as the product.
- In the Host field, enter the IP address of the Site Engine server.
- Leave Encoding as
utf_8, give the source a descriptive Device Name and Tag, and click Save.
Parsed Events
The parser maps the following Site Engine and ExtremeXOS EMS events to Logsign event categories. Events that are not listed are still parsed and are categorized as System / Operation / Info.
| Event | Context / Type / SubType |
|---|---|
nl.ClientAuthenticated |
Identity / User / Login |
nl.ClientUnauthenticated |
Identity / User / Logout |
nl.ClientReset |
Identity / User / Logout |
nl.ClientLinkDown |
Identity / User / Logout |
nl.ClientAuthFailure |
Identity / User / Deny |
nl.Dot1xClientAuthFail |
Identity / User / Deny |
AAA.RADIUS.noServerResp |
Network / Connection / Error |
vlan.msgs.portLinkStateUp |
Network / Interface / Up |
vlan.msgs.portLinkStateDown |
Network / Interface / Down |
HAL.IPv4Mc.L3TblFull |
System / Operation / Error |
| Full Loss of Contact to Switch detected / Full Loss of SNMP Contact to Switch detected | System / Operation / Error |
| Full Loss of Contact to Switch cleared / Full Loss of SNMP Contact to Switch cleared | System / Operation / Info |
| Authentication Error - Could not authenticate User | Identity / User / Deny |
| Re-authentication completed | Identity / User / Login |
For network login events the parser also fills the user name, MAC address, switch port, VLAN, policy name, authentication method and authentication server where the message carries them. The EMS event name is stored in Event.Type and the reason text, when present, in Event.Reason. For 802.1X machine authentication, a user name such as host/PC001.example.local is split into the host name and the domain.
Notes and Troubleshooting
Logs are received but not parsed. Check that the source was added with the product Management Center. A source added as X Series Switch does not parse messages relayed by Site Engine.
The originating switch is missing. In the default Site Engine message the Device field of relayed switch events is often empty, so the switch that produced the event cannot be identified from the log. Switch.IP is filled only for messages that include it, such as re-authentication results. If you need the switch identity on every event, have the switches send syslog directly to Logsign as well.
All events have Info severity. Site Engine forwards these messages with the severity configured on its side, usually Info. Logsign keeps that value, so authentication failures can also appear with Info severity. Use the event category (for example Identity / User / Deny) rather than severity when building alerts.
Time zone. The time zone suffix in the Site Engine timestamp (for example CEST) is not applied. If the Site Engine server and Logsign run in different time zones, use the Offset setting of the source to correct the time.