topic Re: Forward Routing Logs to Syslog/Splunk in Routing and SD-WAN

Forward Routing Logs to Syslog/Splunk

ElishaDean5574 — Mon, 01 Jul 2019 19:56:41 GMT

Currently have logging enabled on my CSR 1000v. I can see configuration changes on splunk, but I cannot see network traffic. Is there a way to configure my logs to forward that information to splunk?

Re: Forward Routing Logs to Syslog/Splunk

balaji.bandi — Mon, 01 Jul 2019 20:03:01 GMT

Can you explain more about network log you looking ? network traffic

Re: Forward Routing Logs to Syslog/Splunk

ElishaDean5574 — Tue, 02 Jul 2019 12:23:01 GMT

I need to forward traffic being sent through my router to Splunk in order to build a dashboard for network traffic. I have "logging trap debugging" turned on. And, I believe that may have done the trick. ISAKMP and ICMP Debugging is turned on and I am receiving those on Splunk, I am hesitant to turn on IP Debugging to see if it works because that is a lot for the router to process. Do you believe this will send all traffic to Splunk?

Re: Forward Routing Logs to Syslog/Splunk

Georg Pauwen — Tue, 02 Jul 2019 13:23:37 GMT

Hello,

I think you need at a minimum the below on your router:

logging trap (trap level)
logging host (Splunk Server) transport (tcp | udp) port (514)
logging on

Re: Forward Routing Logs to Syslog/Splunk

ElishaDean5574 — Tue, 02 Jul 2019 13:25:52 GMT

All of that is enabled. See the images I attached with my message.

Re: Forward Routing Logs to Syslog/Splunk

Jon Marshall — Tue, 02 Jul 2019 15:27:11 GMT

You don't use logging to send the traffic to a remote device and even if you turned on ip debugging (which you don't want to do on a production router) it won't send the actual packets.

If you want to send the packets you need to mirror the port your router is on and then send on copy of that traffic to the port your server is connected to assuming your switch etc. supports that functionality.

Jon

Re: Forward Routing Logs to Syslog/Splunk

ElishaDean5574 — Tue, 02 Jul 2019 17:32:48 GMT

We didn't enable ip debugging, I'm aware that would likely brick the CSR. However, we don't want to actually see the packets, we want to see the amount of traffic in real time. So that we can see the busiest times of day for example.