My network management group with QRadar is telling me that my C3650 switches are sending syslogs, not as needed, but as a burst at 2AM in the morning. Seems odd to me. The log on the switches shows what I believe to be a valid attempt to syslog as needed, but continuously get connection refused.
May 10 22:00:20.670: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: xxx-ne] [Source: 10.248.192.75] [localport: 22] at 22:00:20 UTC Wed May 10 2017
May 10 22:00:21.676: %SYS-3-LOGGINGHOST_FAIL: Logging to host 172.16.25.67 port 514 failed
May 10 22:00:26.684: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 172.16.25.67 port 514 started – reconnection
Syslog config is fairly straightforward...
logging facility syslog
logging source-interface Vlan2
logging host 172.16.25.67 transport tcp port 514
!
Has anyone else seen a periodic burst of syslog from a switch? Or is this QRadar doing something on it's own?
