Solved

cisco syslog logging

Posted on 2013-02-07
11
304 Views
Last Modified: 2013-06-21
Hello Experts

I have configured my router to send syslog messages to my server, however without issuing the command logging source-interface xxxx the the syslog server won't see any syslog messages.

Is there any explanation why?

Cheers

Carlton
0
Comment
Question by:cpatte7372
  • 6
  • 5
11 Comments
 
LVL 28

Expert Comment

by:Jan Springer
ID: 38864202
If your syslog server is firewalled and your cisco router has multiple IPs, the IP originating the syslog packets may not be in the firewall list of allowed tcp/udp port 514.

Have you run wireshark on the syslog server to determine the originating IP
0
 

Author Comment

by:cpatte7372
ID: 38864229
Jesper,

I have disabled the firewall. I do have other interfaces on the syslog server but they are either disconnected or disabled.

I will run wireshark and post the results

Any other suggestions?
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 38864377
Do you have more than one IP address on the router?  I suspect that the syslog packets are not originating from the IP that you want them to.
0
 

Author Comment

by:cpatte7372
ID: 38864551
Hi Jesper

Attached is copy of the configs. There is more than ip address. I'm trying to log to logging 10.44.96.142

Appreciate your help
mxrouter.txt
0
 

Author Comment

by:cpatte7372
ID: 38864710
Experts,

Any thoughts?
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 28

Accepted Solution

by:
Jan Springer earned 500 total points
ID: 38864735
my typical logging config is:

Sample:                                                           Example:

logging buffered <#>                                      logging buffered 32768
no logging console                                          no logging console
logging facility local<#>                                  logging facility local6
logging source-interface <interface>              logging source-interface Vlan1
logging <IP>                                                    logging 10.44.96.142
                                                                       logging 10.44.108.79

Your syslog data from the router may be originating from one of the other IP addresses on the router.  Specifying it is usually necessary.
0
 

Author Comment

by:cpatte7372
ID: 38864809
Jesper,

Thanks for responding. I tried all your suggestions - no luck :-(
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 38864853
Please post either your "syslog.conf" or "rsyslog.conf" and the "/etc/sysconfig/*syslog* file.

Also post "iptables --list -n"

And, I'd like to see a "netstat -an | grep 514"
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 38864856
One little detail:  one the router,

logging on

Then do a "show log" and post the log data minus the actual detail.
0
 

Author Comment

by:cpatte7372
ID: 38865727
Jesper, thanks again for getting back to me. The server is Windows 7, not unix.
0
 

Author Closing Comment

by:cpatte7372
ID: 39265438
Cheers
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

New Server 172.16.200.2  was moved from behind Router R2 f0/1 to behind router R1 int f/01 and has now address 172.16.100.2. But we want users still to be able to connected to it by old IP. How to do it ? We can used destination NAT (DNAT).  In DNAT…
In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now