cisco syslog not receiving logs on siem

[sharon.gatdula]

I configured logging on my 3750 with the following commands.

But when i checked on the server it is not receiving logs. I have the same configured on another device but it is receiving logs on the server. What seems to be the problem here? Am i missing additional configuration?

Thanks for the support.

logging buffered informational
logging history notifications
logging alarm informational
logging facility local6

logging <ip address>

output of show logging
Logging to 10.x.x.x (udp port 514, audit disabled,
authentication disabled, encryption disabled, link up),
162 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled

[marce1000]

 - Below is a thread concerning testing the syslog server ; 

              https://community.cisco.com/t5/network-management/send-custom-message-to-syslog/td-p/1315739

 M.

[balaji.bandi]

what is the switch IP address, and did the switch able to reach your Syslog IP address 10.x.x.x?

do you have any FW in between ?

[sharon.gatdula]

yes it can reach the server. there's no firewall in between.

[balaji.bandi]

what kind of Syslog server is this, do you have any ACL on the switch ?

[sharon.gatdula]

yes i have acl on the switch. syslog server is Arcsight.

[balaji.bandi]

As per the orginal post you have other devices able to send logs to Arcsight, except this device, and you have confirmed that there is ACL, kindly look that ACL may be blocking, as per show logging, you can clearly see that logs are shipped.

2 Options.

1. for testing disable ACL and test it.

2. run debug on Arcsight see from this IP you able to get Logs.