cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3975
Views
5
Helpful
10
Replies
Highlighted
Beginner

Send certain syslog messages to different syslog servers

We have had a security event where we have had to apply certain ACL's to block some traffic.  Some of the blocked traffic is logged to syslog.  We would like to send that log information to different syslog servers, depending on certain pattern matches.

syslog entries that match pattern xxx = export to syslog server A

syslog entries that match pattern yyy = export to syslog server B

Is this possible using something like tcl scripting and EEM?  If so, could someone share some guidance on how this might be accomplished?

TIA

2 ACCEPTED SOLUTIONS

Accepted Solutions
Highlighted
Hall of Fame Cisco Employee

This is possible with the Embedded Syslog Manager.  Let's say you configure:

logging host serverA filtered stream 99

logging host serverB filtered stream 100

Then create a filter, security.tcl:

if { [regexp {xxx} $::orig_msg] } {

    set ::stream 99

    return $::orig_msg

}

if { [regexp {yyy} $::orig_msg] } {

    set ::stream 100

    return $::orig_msg

}

return $::orig_msg

Then configure:

logging filter flash:/security.tcl

View solution in original post

Highlighted
Hall of Fame Cisco Employee

Yes, you can do that with errmsg.  Just add:

errmsg $::severity 110 $::orig_msg

Where you need it.  The 110 value is the stream ID of host C.

View solution in original post

10 REPLIES 10
Highlighted
Hall of Fame Cisco Employee

This is possible with the Embedded Syslog Manager.  Let's say you configure:

logging host serverA filtered stream 99

logging host serverB filtered stream 100

Then create a filter, security.tcl:

if { [regexp {xxx} $::orig_msg] } {

    set ::stream 99

    return $::orig_msg

}

if { [regexp {yyy} $::orig_msg] } {

    set ::stream 100

    return $::orig_msg

}

return $::orig_msg

Then configure:

logging filter flash:/security.tcl

View solution in original post

Highlighted

This is perfect.  It works exactly as we need.  Thank you very much for the prompt answer.

If I may, now that this is working, let me take the question one step further.  What if we need to ...

syslog entries that match pattern xxx = export to syslog server A

syslog entries that match pattern yyy = export to syslog server B

syslog entries that match pattern xxx OR yyy = export to syslog server C

That possible in one filter?  Or would we need to write multiple filters?

Daniel

Highlighted
Hall of Fame Cisco Employee

You can create another stream ID for syslog server C and add the dual check above the other two.  If both max, set the appropriate stream ID and return the message.

Highlighted

Thanks, Joseph.  You answered the question asked...but unfortunately I think that I did not phrase the question correctly.

Our match criteria will always be mutually exclusive, so it will never match both.  Always one or the other.

So now that we have this working in it's basic form, now we want to take it a step further and do the following....

(working) Match criteria A, set Stream 10

(working) Match criteria B, set Stream 20

(working) Send stream 10 to syslog Host A

(working) Send stream 20 to syslog Host B

(NEW) Send stream 10 AND 20 to syslog Host C

Unless we have the syntax incorrect, it appears as though we can only send one stream to a given host.  We can configure 'logging host SyslogC filtered stream 10'.  But if we then configure 'logging host SyslogC filtered stream 20', it appears to overwrite the previous configuration, so that we only send Stream 20 to SyslogC, and not Stream 10.

Is it possible to send multiple streams to a single syslog host?

Thank you!

Highlighted
Hall of Fame Cisco Employee

Yes, you can do that with errmsg.  Just add:

errmsg $::severity 110 $::orig_msg

Where you need it.  The 110 value is the stream ID of host C.

View solution in original post

Highlighted

Great!  So just to be clear...If I understand you correctly, then our final configuration would look something like...

logging host ServerA filtered stream 10

logging host ServerB filtered stream 20

logging host ServerC filtered stream 30

!---flash:/security.tcl---

if { [regexp {xxx} $::orig_msg] } {

   set ::stream 10

   errmsg $::severity 30 $::orig_msg

   return $orig_msg

}

if { [regexp {yyy} $::orig_msg] } {

   set ::stream 20

   errmsg $::severity 30 $::orig_msg

   return $orig_msg

}

-------------------------------------------------

logging filter flash:/security.tcl

This would send both sets of messages to ServerC?  Do I understand this correctly?

Thank you so much for you excellent help.  It is much appreciated.

Highlighted
Hall of Fame Cisco Employee

Yes, that should work.

Highlighted

Tested and confirmed.  Thank you!!

Highlighted

Is there a way to do similarly with IOS-XR.

Highlighted
Hall of Fame Cisco Employee

The ESM feature was never ported to XR as far as I know.  I also do not know if XR has any comparable filtering.  The only other IOS feature that could achieve similar results is the logging discriminator.

Content for Community-Ad