We have about 15 different cisco devices that we want to log all to the same log server. I have installed rhel5 and configured rsyslog to accept remote messages.
I added the following to rsyslog.conf
# Provides UDP syslog reception
# Provides TCP syslog reception
I also added this to /etc/sysconfig/rsyslog:
# Options to syslogd
# -m 0 disables 'MARK' messages.
# -rPortNumber Enables logging from remote machines. The listener will listen to the specified port.
# -x disables DNS lookups on messages recieved with -r
# See syslogd(8) for more details
SYSLOGD_OPTIONS="-m 0 -r514"
# Options to klogd
# -2 prints all kernel oops messages twice; once for klogd to decode, and
# once for processing with 'ksymoops'
# -x disables all klogd processing of oops messages entirely
# See klogd(8) for more details
I tested this with another linux box (redhat desktop 6) and I am receiving the log messages fine and it also made a dir in /var/log/rsyslog for the device and all works great.
I am not a cisco guy but I had the cisco folks here add the ip address of this machine to their config for logging. They are telling me the cisco is configured correctly but I am not receiving anything from them.