Hello,
We have a few Cisco switches here. And since we installed a new Graylog server recently, we thought it would be a good idea to redirect all of our switches' logs to this server. I followed documentation, and logs are indeed redirected to our Graylog server. Though not enough logs are coming. My goal is to set logging to "informal" level. To test things, it is set to "debugging" on most switches. We have some 2960 and 3750.
Here some conf on a 2960 :
switch01#show logging
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
No Active Message Discriminator.
No Inactive Message Discriminator.
Console logging: level debugging, 274 messages logged, xml disabled,
filtering disabled
Monitor logging: level debugging, 0 messages logged, xml disabled,
filtering disabled
Buffer logging: level debugging, 275 messages logged, xml disabled,
filtering disabled
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
File logging: disabled
Persistent logging: disabled
No active filter modules.
Trap logging: level debugging, 278 message lines logged
Logging to 1.1.1.1 (udp port 514, audit disabled,
link up),
8 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging Source-Interface: VRF Name:
switch01#show conf
service timestamps debug datetime msec
service timestamps log datetime msec
logging facility local6
logging 1.1.1.1
logging trap level 7
The switch mentions that 8 lines have been logged to our server. Indeed, that's the case, but it's not enough, it's just interfaces that have gone up or down the past few days...
Do you think I am forgetting something? Can someone recommend me something?
Thanks!
