Syslog in ACI Common vs Default

[udo.konstantin]

Hello, 

I'm currently configure Syslog in ACI. I noticed there are two places where to define the syslog sources. 

• Fabric - Fabric Policies - Policies - Monitoring - Common Policy - Callhome/Smart Callhome/SNMP/Syslog/TACACS
• Fabric - Fabric Policies - Policies - Monitoring - default - Callhome/Smart Callhome/SNMP/Syslog/TACACS

From the Cisco Documentation the Common Policy is the one which is taken if no other more specific policy is assigned.

But it's not clear why the second one default must be configured?  

Any comments? 

Thanks 

Udi 

[Andrea Testino · Accepted solution]

Hi Udi,

Did you see somewhere in the ACI documentation that the "default" one must be configured as well, or just noticed that it gets heavily referenced alongside the common one?

As I understand it, you can have a default policy configured for certain objects and for only certain sources. By doing this, said sources would not be configured for objects in a different hierarchy. On the other hand, configuring common would cover all the objects excluded in a more specific policy. For example, if you were starting in a Greenfield configuration, and you are going to use common source to monitor all objects, then you should only need to configure the "Common Fabric Policy" (this is the scenario wherein you should not need the default one at all).

I'm sure you've run into this before but there's a good ACI syslog technote @ https://community.cisco.com/t5/data-center-documents/technote-syslog-in-the-aci-fabric/ta-p/3163966