Syslog export

[lbe]

Hi everyone,

We are using DNA Center 1.2.6, and I’d like to know if there is a way to export internal DNAC logs to an external Syslog server ?

Thanks,

[Tomas de Leon]

At this time, you can export the logs via Syslog.  You can setup logging for devices and some events are reported to syslog.

To export the Logs from the Cisco DNA Center, you need to perform:

• "sudo rca" from the CLI of "each" Cisco DNAC in the cluster
• use SCP to export logs to external server.

I hope this helps

T.

[lbe]

Thank you Tomas for your reply,

If I understand correctly, your propose a SYSLOG export via manual SCP.

What we need is an export of logs in real time, meaning that each time a log is generated on DNAC, the log is send automatically through SYSLOG protocol to an external server.

Is it possible ? If not possible through SYSLOG, how can we do that ?

Regards,

[Tomas de Leon]

There are two separate things here:

1. Syslog messages are configured to send "Syslog" messages to a syslog server.
2. The RCA logs on the Cisco DNAC which relate to the different services on the Cisco DNAC.

Item#1 is sent directly to the Syslog Server. In addition, SNMP traps can also be sent from the connected\managed devices.

Item#2 is specific to services run on the Cisco DNAC and these have to be exported via another protocol like SCP.  These are not syslog messages.

I hope this clarifies things

Regards

T.

[lbe]

Thank you one again,
For security purpose, we need to export several DNAC logs to an external SYSLOG server in real time (when a user connect or try to connect on DNAC, when a user change or try to change a configuration on DNAC, ...).
These logs are specific to DNAC, so I understand we will have to use SCP to regularly export these logs. Correct ? If yes, do you know if Cisco planned a  syslog export feature in a next release ?
From a security point of view, DNAC is a sensitive tool, security monitoring become mandatory.

Regards

[chunhwon]

Hi All,

any updates on those questions about exporting log in DNAC externally in real time?

Many thanks,
CH

[g.sperryn]

Hi, this is quite an important requirement from a customer POV. Essentially we need a mechanism to export (in real-time) at least the administrative audit event data for ingestion into a SIEM and log archive.