LOGGING TRAP (syslog) failure

[pdoolittle]

I have several switches that are configured for syslog, but will not send traps. Logging is configured and enabled, ip def-gw set, ip address set, etc. I have copied the text from SHOW LOGGING below. As you can see, traps are being generated but not sent. Any ideas?

Philip

main-s5#show log

Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)

Console logging: level debugging, 94 messages logged

Monitor logging: level debugging, 0 messages logged

Buffer logging: level debugging, 94 messages logged

File logging: disabled

Trap logging: level notifications, 99 message lines logged

Logging to 10.1.1.100, 0 message lines logged

[ken.hollis]

Greetings and Salutations:

Make sure that you have the following turned on:

logging trap debugging

logging 10.1.1.100

logging facility local1

syslog local1 (or local0) is set on your UNIX box on the config file.

And there is apparently a bug (at leas on the 8540) that requires you to:

logging source-interface Loopback0

Otherwise there is a CRC error in the formation of the message

Ken

[pdoolittle]

Ken,

Thanks foe the assistance. I had

logging trap debugging

logging 10.1.1.100

but the facility was set to default (local7). I tried it local7 and local1 to no avail.

I also added the logging source-interface lo0 w/o success.

FYI - The syslog client is a freeware windows client. It takes all inbound syslog regardless of source and stuffs them into a text file. The log directory is published via IIS an a page on our intranet web site so my jr. tech can check it easily. It works for a dozen or so other switches, but not for three peculiar ones.

[ken.hollis]

Greetings and Salutations:

I assumed (BTW) that you already had a loopback 0 on the machine. It should be :

logging source-interface (any router interface)

What model are the switches?

We found out the problem with the CRC error by putting a network analyzer on the interface of the router and capturing the output. The analyzer (a sniffer) told us that the packet had a CRC error. I would suggest seeing if you are even getting anything out of the router with a analyzer then working towards the syslog server with the analyzer.

Ken