cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3583
Views
5
Helpful
2
Replies

Multiple syslog server problem

NGnumber62
Beginner
Beginner

I'm just having a semi-annoying problem that I was hoping someone could help with

In my SOHO network, I have a Catalyst 3560G, a 1812W and a ASA 5505 running and am using two Raspberry Pi's as syslog servers.

In all three devices, I have added both log servers, with the ASA though ASDM, and the others though the CLI.  The ASA works fine and sends each log generated to both log servers, however, both the 3560 and the 1812 only send their logs to the first log server on the list - not both servers simultaneously.

I've been over every config document I could find and they all say the same thing - no problem, just add a "logging host <IP>" and the syslog will be sent to both servers - so, yeah...any ideas - are the 1812 and catsw not capable?

1812

logging origin-id hostname
logging 192.168.1.50
logging 192.168.1.51

 

3560

logging count
no logging buffered

logging 192.168.1.50
logging 192.168.1.51

 

ASA

logging enable
logging timestamp
logging trap warnings
logging asdm informational
logging device-id hostname
logging host inside 192.168.1.50
logging host inside 192.168.1.51

 

Josh

1 Accepted Solution

Accepted Solutions

Meheretab Mengistu
Rising star
Rising star
Hi Josh,

If you remove the first log server ('no logging 192.160.1.50'), will they send the logs to .51?
If yes, how about changing the order of the two entries?

Could you also share the output of 'sh logging' and 'sh run | s log'?

HTH,
Meheretab

HTH,
Meheretab

View solution in original post

2 Replies 2

Meheretab Mengistu
Rising star
Rising star
Hi Josh,

If you remove the first log server ('no logging 192.160.1.50'), will they send the logs to .51?
If yes, how about changing the order of the two entries?

Could you also share the output of 'sh logging' and 'sh run | s log'?

HTH,
Meheretab

HTH,
Meheretab

Thanks for the help and sorry to waste everyone's time - I figured it out.  It was a typo in my rsyslog config on the second log server only.  "is equal" is not the same as "isequal".

 

Sorry - but thanks for the help

 

Josh

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: