I'm sure at least some of the information below is already out here, but based upon my recent adventures getting our syslog devices into LEM, I thought it may be handy to have more information on a single page.
The instructions that LEM links to for the configuration of Cisco syslog works fine for switches. For routers you'll need to add some interface information in order to get the desired IP address reported as the Node Name. Current generation ASA firewalls need a completely different configuration. Listed below is what worked in my environment; hope this is helpful:
(All commands issued from the configure terminal # prompt)
SWITCHES
logging host <LEM IP address>
logging facility local2
logging trap debug
end
ROUTERS
logging host <LEM IP address>
logging source-interface <Interface Name>
logging facility local2
logging trap debug
end
ASA FIREWALLS
logging enable
logging timestamp
logging buffer-size 1000000
logging buffered warnings
logging trap debugging
logging asdm debugging
logging facility 18
logging host <Source Interface> <LEM IP address>
end
