I have few devices running Cisco IOS XR. I am sending syslog messages from all devices to Observium.

Everything is fine except for the log messages sent by routers running IOS XR. 

Instead of log Program name, messages sent by XR devices contain an incrementing sequence number, which is being parsed as log Program (Incrementing sequence number being parsed as syslog program = bad. real bad). The actual program name appears much later within the message.

I have gone through the sylog configuration guide for XR routers. Couldnt find anything that would alter the message format of what is being sent. I also configured "logging facility syslog" in XR devices, but that didnt resolve the issue.

To better explain my situation, I have attached a screenshot. Hopefully it would help.

Oh and I am subscriber :)

Thanks,

Senn