Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!
Course Of The Month
3 days, 5 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Cisco Syslog setup - Send to syslog server
Posted on 2013-01-03
I have set up my cisco to send the syslog to a syslog server, but it is showing link down on that ip address for the server.
Has anyone done this and know why it is showing link down?
Below is the configuration.
Console logging: level debugging, 991 messages logged, xml disabled,
filtering disabled
Monitor logging: level debugging, 0 messages logged, xml disabled,
filtering disabled
Buffer logging: level warnings, 757 messages logged, xml disabled,
filtering disabled
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled
Trap logging: level warnings, 1034 message lines logged
Logging to x.x.x.x (tcp port 515, audit disabled,
link down),
0 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging to x.x.x.x (tcp port 514, audit disabled,
link down),
0 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging Source-Interface: VRF Name:
GigabitEthernet0/1
Has anyone done this and know why it is showing link down?
Below is the configuration.
Console logging: level debugging, 991 messages logged, xml disabled,
filtering disabled
Monitor logging: level debugging, 0 messages logged, xml disabled,
filtering disabled
Buffer logging: level warnings, 757 messages logged, xml disabled,
filtering disabled
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled
Trap logging: level warnings, 1034 message lines logged
Logging to x.x.x.x (tcp port 515, audit disabled,
link down),
0 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging to x.x.x.x (tcp port 514, audit disabled,
link down),
0 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging Source-Interface: VRF Name:
GigabitEthernet0/1
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
4
3
3
10 Comments
Active today
Hi,
because it may not succeed in opening the socket on tcp port 514 (e.g.: the syslog server may not be listening on that port).
It is usually easier to let logs flow through udp port 514
hope this helps
max
because it may not succeed in opening the socket on tcp port 514 (e.g.: the syslog server may not be listening on that port).
It is usually easier to let logs flow through udp port 514
hope this helps
max
So the server is reachable, syslog service is running and listening on those ports (normally it's using UDP)?
server is reachable (though it is a third party vendors server) but even on udp port it is still not showing as link up.
Logging to x.x.x.x (udp port 515, audit disabled,
link down),
0 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging Source-Interface: VRF Name:
GigabitEthernet0/1
Logging to x.x.x.x (udp port 515, audit disabled,
link down),
0 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging Source-Interface: VRF Name:
GigabitEthernet0/1
Active today
there may be some mess on the sockets ... it might fix with a reload
please have a look at the following, it seems a very similar issue
https://supportforums.cisco.com/thread/1004039
hope this helps
max
please have a look at the following, it seems a very similar issue
https://supportforums.cisco.com/thread/1004039
hope this helps
max
So are you able to check the server to see if everything is up and running there? Also no firewall blocking anything?
And are you sure the server is listening on port 515? Like max said, normally syslog uses UDP port 514.
And are you sure the server is listening on port 515? Like max said, normally syslog uses UDP port 514.
I have it set up for udp port 514 and 515, but the server is controlled by a third party vendor. This is all they do is run the syslog servers.
I will try the reload after hours when I am able to reload and see if that brings this up.
I will try the reload after hours when I am able to reload and see if that brings this up.
Active today
hi considerscs,
i believe you should use udp port for syslogging cisco devices (unless you want to write some C programs to adjust log format ...).
Then please:
1) check that your syslog server is listening on an udp port (be sure which one is - usually it is udp port 514, try and use that one)
2) remove your log host from cisco device configuration (no loggin host ...)
3) add up your loggin host again to cisco device configuration (loggin host ...)
4) test if it is successful
hope this helps
max
i believe you should use udp port for syslogging cisco devices (unless you want to write some C programs to adjust log format ...).
Then please:
1) check that your syslog server is listening on an udp port (be sure which one is - usually it is udp port 514, try and use that one)
2) remove your log host from cisco device configuration (no loggin host ...)
3) add up your loggin host again to cisco device configuration (loggin host ...)
4) test if it is successful
hope this helps
max
I think you might also want to check with the 3rd party vendor and let them check if everything is ok.
If you set up another device to send syslogs to the server, does that come through?
If you set up another device to send syslogs to the server, does that come through?
Featured Post
WannaCry is just the start. Read how Liquid Web is protecting itself and its customers against new threats.
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
When you try to share a printer , you may receive one of the following error messages.
Error message when you use the Add Printer Wizard to share a printer:
Windows could not share your printer. Operation could not be completed (Error 0x000006…
Let’s face it: one of the reasons your organization chose a SaaS solution (whether Microsoft Dynamics 365, Netsuite or SAP) is that it is subscription-based. The upkeep is done. Or so you think.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:
• Key questions to ask when considering a partnership to accelerate your business into the cloud
• Pitfalls and mistakes other partners…
Suggested Courses
Course of the Month3 days, 5 hours left to enroll
Earn Certification
Cisco CCNA R&S: ICND2 v3
$197.00$177.30
Earn Certification
Cisco CCNA Data Center: DCICT
$197.00$177.30
695 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.