[Last Call] Learn about multicloud storage options and how to improve your company's cloud strategy. Register Now

x
?
Solved

Cisco Syslog setup - Send to syslog server

Posted on 2013-01-03
10
Medium Priority
?
3,061 Views
Last Modified: 2013-01-04
I have set up my cisco to send the syslog to a syslog server, but it is showing link down on that ip address for the server.

Has anyone done this and know why it is showing link down?

Below is the configuration.

Console logging: level debugging, 991 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging:  level warnings, 757 messages logged, xml disabled,
                    filtering disabled
    Exception Logging: size (4096 bytes)
    Count and timestamp logging messages: disabled
    Persistent logging: disabled
    Trap logging: level warnings, 1034 message lines logged
        Logging to x.x.x.x  (tcp port 515, audit disabled,
              link down),
              0 message lines logged,
              0 message lines rate-limited,
              0 message lines dropped-by-MD,
              xml disabled, sequence number disabled
              filtering disabled
        Logging to x.x.x.x  (tcp port 514, audit disabled,
              link down),
              0 message lines logged,
              0 message lines rate-limited,
              0 message lines dropped-by-MD,
              xml disabled, sequence number disabled
              filtering disabled
        Logging Source-Interface:       VRF Name:
        GigabitEthernet0/1
0
Comment
Question by:considerscs
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 3
10 Comments
 
LVL 17

Expert Comment

by:max_the_king
ID: 38740412
Hi,
because it may not succeed in opening the socket on tcp port 514 (e.g.: the syslog server may not be listening on that port).
It is usually easier to let logs flow through udp port 514

hope this helps
max
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 38740425
So the server is reachable, syslog service is running and listening on those ports (normally it's using UDP)?
0
 
LVL 1

Author Comment

by:considerscs
ID: 38740499
server is reachable (though it is a third party vendors server) but even on udp port it is still not showing as link up.

Logging to x.x.x.x  (udp port 515, audit disabled,
              link down),
              0 message lines logged,
              0 message lines rate-limited,
              0 message lines dropped-by-MD,
              xml disabled, sequence number disabled
              filtering disabled
        Logging Source-Interface:       VRF Name:
        GigabitEthernet0/1
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 17

Expert Comment

by:max_the_king
ID: 38740536
there may be some mess on the sockets ... it might fix with a reload

please have a look at the following, it seems a very similar issue

https://supportforums.cisco.com/thread/1004039

hope this helps
max
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 38740541
So are you able to check the server to see if everything is up and running there? Also no firewall blocking anything?
And are you sure the server is listening on port 515? Like max said, normally syslog uses UDP port 514.
0
 
LVL 1

Author Comment

by:considerscs
ID: 38740569
I have it set up for udp port 514 and 515, but the server is controlled by a third party vendor.  This is all they do is run the syslog servers.

I will try the reload after hours when I am able to reload and see if that brings this up.
0
 
LVL 1

Author Comment

by:considerscs
ID: 38742622
the reboot did not work, they are all still showing down.
0
 
LVL 17

Accepted Solution

by:
max_the_king earned 2000 total points
ID: 38743177
hi considerscs,
i believe you should use udp port for syslogging cisco devices (unless you want to write some C programs to adjust log format ...).
Then please:
1) check that your syslog server is listening on an udp port (be sure which one is - usually it is udp port 514, try and use that one)
2) remove your log host from cisco device configuration (no loggin host ...)
3) add up your loggin host again to cisco device configuration (loggin host ...)
4) test if it is successful

hope this helps
max
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 38743200
I think you might also want to check with the 3rd party vendor and let them check if everything is ok.
If you set up another device to send syslogs to the server, does that come through?
0
 
LVL 1

Author Closing Comment

by:considerscs
ID: 38743780
This came up after doing this.
0

Featured Post

Plesk WordPress Toolkit

Plesk's WordPress Toolkit allows server administrators, resellers and customers to manage their WordPress instances, enabling a variety of development workflows for WordPress admins of all skill levels, from beginners to pros.

See why 2/3 of Plesk servers use it.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you’re involved with your company’s wide area network (WAN), you’ve probably heard about SD-WANs. They’re the “boy wonder” of networking, ostensibly allowing companies to replace expensive MPLS lines with low-cost Internet access. But, are they …
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …

650 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question