topic Re: Syslos export in Cisco Catalyst Center

Syslog export

lbe — Sat, 09 Mar 2019 01:30:38 GMT

Hi everyone,

We are using DNA Center 1.2.6, and I’d like to know if there is a way to export internal DNAC logs to an external Syslog server ?

Thanks,

Re: Syslos export

Tomas de Leon — Mon, 04 Feb 2019 13:10:14 GMT

At this time, you can export the logs via Syslog. You can setup logging for devices and some events are reported to syslog.

To export the Logs from the Cisco DNA Center, you need to perform:

"sudo rca" from the CLI of "each" Cisco DNAC in the cluster
use SCP to export logs to external server.

I hope this helps

Re: Syslos export

lbe — Tue, 05 Feb 2019 14:01:13 GMT

Thank you Tomas for your reply,

If I understand correctly, your propose a SYSLOG export via manual SCP.

What we need is an export of logs in real time, meaning that each time a log is generated on DNAC, the log is send automatically through SYSLOG protocol to an external server.

Is it possible ? If not possible through SYSLOG, how can we do that ?

Regards,

Re: Syslos export

Tomas de Leon — Tue, 05 Feb 2019 15:00:22 GMT

There are two separate things here:

Syslog messages are configured to send "Syslog" messages to a syslog server.
The RCA logs on the Cisco DNAC which relate to the different services on the Cisco DNAC.

Item#1 is sent directly to the Syslog Server. In addition, SNMP traps can also be sent from the connected\managed devices.

Item#2 is specific to services run on the Cisco DNAC and these have to be exported via another protocol like SCP. These are not syslog messages.

I hope this clarifies things

Regards

Re: Syslos export

lbe — Fri, 08 Feb 2019 17:05:44 GMT

Thank you one again,
For security purpose, we need to export several DNAC logs to an external SYSLOG server in real time (when a user connect or try to connect on DNAC, when a user change or try to change a configuration on DNAC, ...).
These logs are specific to DNAC, so I understand we will have to use SCP to regularly export these logs. Correct ? If yes, do you know if Cisco planned a syslog export feature in a next release ?
From a security point of view, DNAC is a sensitive tool, security monitoring become mandatory.

Regards

Re: Syslos export

chunhwon — Mon, 10 Jun 2019 14:46:32 GMT

Hi All,

any updates on those questions about exporting log in DNAC externally in real time?

Many thanks,
CH

Re: Syslos export

g.sperryn — Tue, 11 Feb 2020 13:58:48 GMT

Hi, this is quite an important requirement from a customer POV. Essentially we need a mechanism to export (in real-time) at least the administrative audit event data for ingestion into a SIEM and log archive.