Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Not getting logs from Cisco into NPM Syslog

Not sure what is going on here. Ive been trying to get my bgp logs into syslog and it just isnt working. I am getting %SYS-5-CONFIG_I: Configured from console by user on vty0 (x.x.x.x), so this confirms my logging is working. But when I clear ip bgp x.x.x.x, my syslog does not report %BGP-5-ADJCHANGE: neighbor x.x.x.x Down User reset and %BGP-5-ADJCHANGE: neighbor x.x.x.x Up. Am I missing something here? Does the syslog not receive the change because the connection is disrupted during the reset? If this is the case, how do log the changes?

Current router logging config:

logging buffered 50000 notifications

logging console notifications

logging source-interface Loopback0

logging x.x.x.x

Thans in advance!

Bret

Find more posts tagged with

Accepted answers

All comments

netlogix

have you checked (from cmd):

sc query SolarwindsSyslogService (Solarwinds Syslog service running?)

netstat -ano | find "514" (You should get a line like: " UDP [::]:514 *:* 2212" if it is listening)

tasklist | find "SyslogService.exe" (Make sure the PID is the same on this line and the previous - maybe something else is listening on syslog port)

sc stop MpsSvc (stop windows firewall)

Next would be to see if the traffic is getting to the server - a network based firewall might be blocking it.

kindbro

Thanks for the resonse netlogix, none of those are the issue. The router is sending logs to the syslog server, but the router is not sending bgp logs.

dstj

Did you enable 'bgp log-neighbor-changes' on the router ?...

http://www.cisco.com/en/US/docs/ios/12_0/np1/command/reference/1rbgp.html#wp1018068

eg..

BGP router 100

bgp log-neighbor-changes

Dave

kindbro

Yes I have log-neighbor-changes. Logs are being greated for BGP to the syslog buffer, but the logs are not being delivered for those logs to the server. Where as, the configuration change logs are being sent to the syslog server.

netlogix

Is there some syslog rule that might being doing something dumb with it? If it's showing up in the buffer then that mean "notification" level should be good... I would say do a network capture if you can, that way you can isolate it to either Orion "misplacing" it or if it's the router not sending it. I like to do yes/no tests to lower the amount of guess work.

kindbro

Ok, so I did a packet capture. My packet capture revealed that I am getting logs from the router. As a test I shut, then no shut a local interface and the proper logs got sent to buffer. Then I did a clear ip bgp x.x.x.x and the logs were written to buffer. But when I look at my packet capture for these logs they are not there.

I believe the problem is when BGP is reset. Because a small moment of network disruption is experienced the log cant be sent. So now the problem exist in how do you send to a syslog when connectivity is restored? Things that make you hmmm.