Syslog server for CAT switches

[bevans]

I am looking to setup syslogging for all my CAT switches. I have setup a server with syslog running on it and it is tested and working. I have setup a single switch as test with the following configuration added:

logging "ip address of server"

logging trap warning

logging facility local6

ntp server "ip address of server"

With the above configuration nothing logs to my syslog server. What is wrong? Please help!

Bill

[erochekelly]

Is your syslog server actually getting packets? Run snoop or similar to test.

How is your syslog server configured to deal with local6 messages? You should have a line starting with "local6." that specifies what file to send it to.

Also, you could configure the switch with

"logging facility syslog" which will put the

syslog messages into the standard syslog file.

Ed

[bevans]

Thank you for the post. I am running Kiwi Syslog Daemon on Win2k just so you know. I tried using the command "logging facility syslog" as you mentioned and I am still not getting anything in the logs. Any other ideas?

Bill

[erochekelly]

Sorry, I assumed you were using Unix.

Do you have a sniffer that can capture traffic between the switch and the syslog server?

You could try "logging trap debugging" so you

get all syslog messages (with "logging trap warning"

you'll only get messages of levels 0-4).

Do show logging on the switch, there should be a

line like

"Logging to a.b.c.d, n message lines logged"

where a.b.c.d is your host, and n is the number of lines the switch has sent to the syslog server.

ed

[paumercier · Accepted solution]

bill,

I run kiwi syslog for both catOS and IOS switches. Have you set the kiwi snmp tab to local6 (the defualt is 7). Also which version of os are you using? The cat OS requires a set logg enable.

Regards,

Paul

[bevans]

Thank you both for your posts. I have set the snmp tab to local6. Also, my switch is running catOS (version is 7.61, very recent) with the following set:

#syslog

set logging server enable

set logging server 10.10.1.23

set logging level ethc 2 default

set logging level gl2pt 2 default

set logging server facility LOCAL6

I am still not sure why this isnt working for me. Any ideas?

Bill

[milan.kulik]

Hi,

try

set logging level spantree 6 default

set logging server severity 6

and make some port (which is not portfast for sure) to go up/down.

If your logging works OK, you should receive a syslog message on your server.

Regards,

Milan

[bevans]

Thank you all for your posts and expertise. I was able to resolve this issue with an adjustment to the snmp settings in my syslog server (the default options did not work). The switch configuration was right all along.

Bill