Log Servers

[John N]

As anyone created central log servers to report any alerts to admins for Cisco 3850 switches? Our switches are hosted on VMWare.  First question is should the log servers be created within VMmotion? Or maybe separate somewhere on the network? Second question is there a process on how to create log servers for Cisco switches?

[Flavio Miranda]

@John N  

 Do you mean Syslog Server?  syslog is pretty easy to configure on cisco switch. You can follow this guide

https://www.auvik.com/franklyit/blog/configure-syslog-cisco/

If you are looking for traffic visibility, you can take a look in Netflow.

https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/netflow/Cisco_NetFlow_Configuration.pdf

[John N]

Thanks for this... This is a dumb question but this is how to setup a syslog server on the switch..... My understanding I will need to set up the syslog servers separately on the network no?  

[Flavio Miranda]

Yes. On the switch, you will enable logging and you will point the logging to an IP address of your server. That´s it. The server will receive the logs generated by the swich. 

What you can do also is change the logging level on the switch in order to send more or less log depending on your needs. 

[John N]

Thank you....I have a Gray Log server but don't know how to point it to all my switches....