topic Re: Cisco DNA and syslog in Cisco Catalyst Center

Cisco DNA and syslog

GordonPereira24745 — Thu, 20 May 2021 09:01:17 GMT

We have our devices that have configured logging to DNA as a syslog server. No matter where I look in DNA I'm not able to see the logs for the devices. I would assume it would be in assurance but it's not on there.

Re: Cisco DNA and syslog

balaji.bandi — Thu, 20 May 2021 09:44:34 GMT

what version of DNAC ?

some refence : you should be able to see Logs in Kibana.

https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/2-1-2/user_guide/b_cisco_dna_center_ug_2_1_2/b_cisco_dna_center_ug_2_1_1_chapter_01010.html#id_133258

Re: Cisco DNA and syslog

GordonPereira24745 — Thu, 20 May 2021 09:48:59 GMT

Version 2.1.2.5

Do i need Kibana to be installed for it to work?

Re: Cisco DNA and syslog

balaji.bandi — Thu, 20 May 2021 11:05:04 GMT

I mean DNAC as syslog has limited functional information it hold as i remember only 2GB file and overwrite.

internall DNAC use rsyslog - you can view the logs /var/log/syslog

This syslog good for audit logs, suggested personally use external syslog Server if you have big infra looking logs to be stored.

Re: Cisco DNA and syslog

AFlack20 — Thu, 04 Nov 2021 21:30:20 GMT

Having logged into the VIP of my cluster, I don't have a folder for syslog under /var/log/

Does this mean I don't have log collection enabled on my DNAC cluster?

DNAC version 2.2.2.5

Re: Cisco DNA and syslog

balaji.bandi — Fri, 05 Nov 2021 08:17:21 GMT

the system should default log configured for to store process logs.

can you post ls -al /var/log

Re: Cisco DNA and syslog

rasmus.elmholt — Fri, 05 Nov 2021 10:10:30 GMT

Hi,

All syslog from the network devices is collected by the syslog service within DNAC: collector-syslog

If you want to look into these logs you have to get into the service and look at the service.

Re: Cisco DNA and syslog

AFlack20 — Fri, 05 Nov 2021 18:23:38 GMT

How do i get to the shell to execute ls command?

Re: Cisco DNA and syslog

balaji.bandi — Sat, 06 Nov 2021 08:03:11 GMT

I don't have a folder for syslog under /var/log/

The same way you have checked above and confirmed there is no Syslog in ./var/log ( syslog is file not folder.)

Re: Cisco DNA and syslog

rasmus.elmholt — Mon, 08 Nov 2021 09:34:44 GMT

As you can see here all external syslog messages to the DNAC on UDP port 514 is forwarded to the syslog collector service. /var/log/syslog only contains the log messages from the DNAC itself.

$ kubectl get svc --all-namespaces | grep 514
ndp                        collector-syslog-ext                    NodePort    10.240.255.74    <none>        514:514/UDP

Re: Cisco DNA and syslog

AFlack20 — Mon, 08 Nov 2021 18:29:07 GMT

I've just been using win scp to login and view files/folders.

Re: Cisco DNA and syslog

AFlack20 — Mon, 08 Nov 2021 18:30:36 GMT

You're saying DNA doesn't store any device logs?

Re: Cisco DNA and syslog

rasmus.elmholt — Mon, 08 Nov 2021 20:59:21 GMT

Hi,

I have asked a couple of times on how to find the syslogs DNAC receives, but every time i get the answer that it does not retain this information after it has been handled by the services that uses it.

If you look in Device 360 you will sometimes see a syslog message, but I am not sure you can get the complete log.

To find that you need to dig around in the services. But PLEASE DONT do that.

$ sudo iptables-save | egrep "syslog|514"
-A KUBE-NODEPORTS -s 127.0.0.0/8 -p udp -m comment --comment "ndp/collector-syslog-ext:comm" -m udp --dport 514 -j KUBE-MARK-MASQ
-A KUBE-NODEPORTS -p udp -m comment --comment "ndp/collector-syslog-ext:comm" -m udp --dport 514 -j KUBE-XLB-N5GI6L3INWUEK5QW
-A KUBE-SEP-2KOFCNR2S7SDDLAH -p udp -m udp -j DNAT --to-destination 169.254.35.189:10514
-A KUBE-SERVICES ! -s 169.254.32.0/20 -d 169.254.49.96/32 -p tcp -m comment --comment "ndp/collector-syslog:api cluster IP" -m tcp --dport 8000 -j KUBE-MARK-MASQ
-A KUBE-SERVICES -d 169.254.49.96/32 -p tcp -m comment --comment "ndp/collector-syslog:api cluster IP" -m tcp --dport 8000 -j KUBE-SVC-J27CZZFDENYB5PH5
-A KUBE-SERVICES ! -s 169.254.32.0/20 -d 169.254.62.189/32 -p udp -m comment --comment "ndp/collector-syslog-ext:comm cluster IP" -m udp --dport 514 -j KUBE-MARK-MASQ
-A KUBE-SERVICES -d 169.254.62.189/32 -p udp -m comment --comment "ndp/collector-syslog-ext:comm cluster IP" -m udp --dport 514 -j KUBE-SVC-N5GI6L3INWUEK5QW
-A KUBE-XLB-N5GI6L3INWUEK5QW -m comment --comment "masquerade LOCAL traffic for ndp/collector-syslog-ext:comm LB IP" -m addrtype --src-type LOCAL -j KUBE-MARK-MASQ
-A KUBE-XLB-N5GI6L3INWUEK5QW -m comment --comment "route LOCAL traffic for ndp/collector-syslog-ext:comm LB IP to service chain" -m addrtype --src-type LOCAL -j KUBE-SVC-N5GI6L3INWUEK5QW
-A KUBE-XLB-N5GI6L3INWUEK5QW -m comment --comment "Balancing rule 0 for ndp/collector-syslog-ext:comm" -j KUBE-SEP-2KOFCNR2S7SDDLAH

$ magctl service attach collector-syslog-

Attaching to 'ndp/collector-syslog-db97c5f8-w2xnt'
root@collector-syslog-db97c5f8-w2xnt:/# ip a
4: eth0@if535: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1400 qdisc noqueue state UP group default
    link/ether 5e:ae:f8:1f:67:0e brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 169.254.35.189/32 scope global eth0
       valid_lft forever preferred_lft forever

root@collector-syslog-db97c5f8-w2xnt:/# netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp6       0      0 :::8079                 :::*                    LISTEN      -
udp6       0      0 :::10514                :::*                                -

Re: Cisco DNA and syslog

csedlmeier — Tue, 16 Nov 2021 05:51:26 GMT

Sorry if I asked again, but it is still not clear for me here. I understand network devices send syslog to DNAC. There is Kibana but Kibana seem to be for internal message. For syslog from network devices there is no GUI. It also seem there is no syslog stored on DNAC from network devices because it is send to DNAC from network device, used by services in DNAC but not real store like in Cisco Prime to read through syslog from Network devices ?

Re: Cisco DNA and syslog

rasmus.elmholt — Tue, 16 Nov 2021 07:45:02 GMT

To my understanding that is correct. The DNAC receives the syslog and a service handles them and sendt an event with the information on to the other services, but does not store it permanently.

But I am not a Cisco Employee so this is only what I have been able to figure out. If it is true or not, I don't know.

Re: Cisco DNA and syslog

stayd — Wed, 31 Jan 2024 18:29:09 GMT

Hi, is there some updates on this? In 2021 was version DNAC version 2.2.2.5, now we are in 2024 version on appliances 2.3.5.5.

How does it work syslog in Catalyst Center today ?