topic Re: WLC Doesn't Send Logs to SysLog Server in Wireless

WLC Doesn't Send Logs to SysLog Server

WGL_BK — Mon, 05 Jul 2021 19:26:56 GMT

Hello all.

I've set my 5520 to send syslog messages to my remote syslog server (Solarwinds) but I'm seeing no logs generated over a couple weeks. This is my current config. I've tried setting the facility level to Syslog and to Local 0 but nothing seems to work. Have I misconfigured something here? I'm hoping to get as much information as possible from the WLC for troubleshooting purposes.

Re: WLC Doesn't Send Logs to SysLog Server

Mark Elsen — Wed, 26 Aug 2020 17:22:32 GMT

- Try adding another syslog-server/type as a sanity test.

Re: WLC Doesn't Send Logs to SysLog Server

Rasika Nayanajith — Wed, 26 Aug 2020 19:25:23 GMT

Pls check "show logging" output from WLC CLI and see if that give any indication of msg being logged

HTH

Rasika

Re: WLC Doesn't Send Logs to SysLog Server

WGL_BK — Wed, 26 Aug 2020 19:29:17 GMT

Hi, thanks for your reply. Below is the syslog section of the command:

Logging to syslog :
- Syslog facility................................ local7
- Logging of system messages to syslog :
- Logging filter level.......................... informational
- Number of system messages logged.............. 2095803
- Number of system messages dropped............. 170230
- Logging of debug messages to syslog ........... Disabled

--More-- or (q)uit
- Number of debug messages logged............... 0
- Number of debug messages dropped.............. 0
- Number of remote syslog hosts.................. 1
- syslog over tls................................ Disabled
- syslog over ipsec.............................. Disabled
- ipsec profile inuse for syslog................. none
- Host 0....................................... 10.0.99.51

Re: WLC Doesn't Send Logs to SysLog Server

WGL_BK — Wed, 26 Aug 2020 19:30:10 GMT

Thanks for the quick reply. I put Kiwi syslog on another PC and I'm waiting for results.

Re: WLC Doesn't Send Logs to SysLog Server

Rasika Nayanajith — Wed, 26 Aug 2020 19:37:32 GMT

Based on this output, it seems WLC sending syslog. I would check on solarwinds side to see if it receive these syslogs. If you can take a few min wireshark packet capture of WLC trunk port, that tells exact story.

- Logging filter level.......................... informational
- Number of system messages logged.............. 2095803
- Number of system messages dropped............. 170230

HTH

Rasika

Re: WLC Doesn't Send Logs to SysLog Server

WGL_BK — Wed, 26 Aug 2020 19:46:20 GMT

Hmm, thank you Rasika. I'll try to tackle this from the recipient server side.

Re: WLC Doesn't Send Logs to SysLog Server

WGL_BK — Wed, 26 Aug 2020 19:52:07 GMT

I may have jumped the gun here. Wireshark isn't showing UDP 514 destined traffic from my WLC, mostly SNMP instead.

Re: WLC Doesn't Send Logs to SysLog Server

Rasika Nayanajith — Wed, 26 Aug 2020 20:21:59 GMT

I would remove and re-add those syslog host configuration & check again.

config logging syslog host server_IP_address

https://www.cisco.com/c/en/us/support/docs/wireless/4100-series-wireless-lan-controllers/107252-WLC-Syslog-Server.html

HTH

Rasika

Re: WLC Doesn't Send Logs to SysLog Server

WGL_BK — Wed, 26 Aug 2020 20:40:35 GMT

I found the problem. Someone had an interface on the WLC with an IP address that would have been in the same subnet (10.0.99.x) as the syslog server but it was unused and not in a proper vlan. They hadn't removed it so the WLC was using this interface and sending the traffic to nowhere. Silly situation. Thank you for the guidance.

Re: WLC Doesn't Send Logs to SysLog Server

Rasika Nayanajith — Wed, 26 Aug 2020 20:43:59 GMT

Good to hear you found the issue. Yes, it is a simple mistake...

Rasika