Syslog setup for a Cisco 7609

Question

Greetings

I have set up a Cisco 7609 for snmp and syslog and set the logging server to the private IP we have assigned.

Using the send log command I sent a log message from the 7609 to the Solar Winds server. My colleague was wiresharking the port the Solar Winds server was connected to and verified that he saw the message I sent with level 0. I can ping from the 7609 to the Solar Winds server and vice versa.

However when I check the Solar Winds GUI no syslog messages were received from the 7609. Any ideas?

Thanks

Bill

rschroeder · Accepted Answer

Here's the top section of a "show log" on one of my 7609's.  I'd expect you'd have somewhat similar output.  Note that this box is logging to multiple destinations. #sho log Syslog logging: enabled (0 messages dropped, 19 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled) No Active Message Discriminator. No Inactive Message Discriminator.     Console logging: level (omitted), 191156 messages logged, xml disabled,                      filtering disabled     Monitor logging: level (omitted), 47 messages logged, xml disabled,                      filtering disabled     Buffer logging:  level (omitted), 182753 messages logged, xml disabled,                     filtering disabled     Exception Logging: size (4096 bytes)     Count and timestamp logging messages: (omitted)     Persistent logging: (omitted) No active filter modules.     Trap logging: level informational, 276832 message lines logged        Logging to x.x.x.x   (udp port 514, audit disabled,               link up),               276817 message lines logged,               0 message lines rate-limited,               0 message lines dropped-by-MD,               xml disabled, sequence number disabled               filtering disabled         Logging to y.y.y.y   (udp port 514, audit disabled,               link up),               94214 message lines logged,               0 message lines rate-limited,               0 message lines dropped-by-MD,               xml disabled, sequence number disabled               filtering disabled         Logging to z.z.z.z   (udp port 514, audit disabled,               link up),               94214 message lines logged,               0 message lines rate-limited,               0 message lines dropped-by-MD,               xml disabled, sequence number disabled               filtering disabled         Logging Source-Interface:       VRF Name:         Loopback0 Here's a 7609 "show run | in log" to compare with your 7609's config: sho run | in log service timestamps log datetime msec localtime logging buffered 65535 vlan access-log ratelimit (some number) (multiple interface logging records omitted) bgp log-neighbor-changes logging source-interface (put in the appropriate source interface here) logging x.x.x.x logging y.y.y.y logging  z.z.z.z As long as you have logging enabled , have it set to the appropriate level (Informational for starters, I'd suggest), and you are sending it from the appropriate interface, and are sending it to the correct destination IP address , your 7609 is likely configured correctly. Put Wireshark on your destination syslog / NPM poller and generate some traffic by entering config mode and existing it, or renaming an interface and saving the config.  Now use Wireshark to ensure that your Poller's address is receiving the traffic from your 7609.  If it's not, then you have eliminated Orion as the problem--you can focus on the 7609. If the poller IS receiving the traffic, then you've eliminated the 7609, so you can troubleshoot NPM's syslogging. I bet you'll start off the new year with a perfect diagnosis and a good fix!  If you don't find the problem, check out Cisco's Support Forum site for 7600 logging at:  How to configure logging in Cisco IOS | Other Network Infrastructure Subjects | Cisco Support Community | 5981 | 24661 Swift packets! Rick S.

Syslog setup for a Cisco 7609

Top Replies