rsyslog on router/switch and "syslog facility"

[roncro]

Hello,

I am trying to set up remote logging with rsyslog. But all the messages form the router (Cisco 2952) and switches (Cisco 2960) keep ending up in /var/log/messages (RHEL) is that because of the "Syslog Facility" I use, 'local7'? I want the log messages for each individual host (router, switch, AP) to be logged into a separate file, not all n messages.  (probably a little off topic, since I think it might be  a RHEL issue rather than a cisco ios issue).

thanks,

Ron

[marce1000]

You should define a template for log files in syslog.conf , something like e.g :

# log every host in its own directory
$template RemoteHost,"/var/syslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/syslog.log"

Then apply this template to messages coming from remote hosts :

# Remote Logging
$RuleSet remote
*.* ?RemoteHost

 M.

[roncro]

I did that,  originally I put this script in /etc/rsyslog.d :

$template NetworkLogs,"/var/log/network/%HOSTNAME%-messages.log"
*.* ?NetworkLogs

& stop

but the "& stop" seemed to break it.   After I removed it, it started working.  However it is also logging the "local host" as if it is a remote host.

Also, I managed to get the router logging, but it logs as "gateway",  can that be changed to the name of the router?

And also, I turned  rsyslog on, on both of my switches (Cisco 2960)  but they don't seem to be logging anything

I set:

logging trap errors
logging 192.168.2.8

but I don't see "anything"  what is the best level for logging on a Cisco 2960 switch?

(if I set logging to 'informational' severity=6,  do I get everything lower than that too?)

thanks,

Ron

[marce1000]

      >...but I don't see "anything"  what is the best level for logging on a Cisco 2960 switch?
 - Depends on how verbose you want the logging to be ; the most verbose level is :
                              logging trap debugging , 

 M.

[roncro]

yes, but if I set it to 6, informational, do I get everything but debugging?  or just the informational messages?

[liviu.gheorghe]

Using Ububtu as a syslog server, I did the following:

1. In /etc/rsyslog.conf, you should have a line at the end of the file

$IncludeConfig /etc/rsyslog.d/*.conf

2. In /etc/rsyslog.d/ create a file named 25-cisco.conf with the following content:

#Logging messages from FPR appliance
if $fromhost-ip startswith '172.25.25.200' then /var/log/cisco/fpr.log
& stop
if $fromhost-ip startswith '172.25.25.199' then /var/log/cisco/fpr.log
& stop
#Logging messages from Catalyst 9200 switch
if $fromhost-ip startswith '172.25.25.202' then /var/log/cisco/cat9200.log
& stop
#Logging messages from ISR1111
if $fromhost-ip startswith '192.168.1.1' then /var/log/cisco/isr.log
& stop
#Logging messages from terminal server
if $fromhost-ip startswith '172.25.25.211' then /var/log/cisco/c2611ts.log
& stop

3. Restart the rsyslog daemon:

sudo systemctl restart rsyslog.service

4. On the devices you configure:

logging host <IP_address>

logging trap <level>

Now you should have in /var/log/cisco/ the individual files for the equipment defined in the file /etc/rsyslog.d/25-cisco.conf

Hope this helps.

[roncro]

thanks,  I tried this earlier:

$template NetworkLogs,"/var/log/network/%HOSTNAME%-messages.log"
 *.* ?NetworkLogs

but apparently the hostname doesn't resolve correctly all the time it seems.

if I set logging trap to "informational"  (severity 6)  does it log everything except debugging?

thanks,

Ron

[roncro]

btw:  I noticed something "odd".   the router is 192.168.1.1, switch1 is 192.168.1.2 switch2 is 192.168.1.3 and the logging server is 192.168.2.8

the messages from the router seem to be coming from 192.168.2.1 and the switches 192.168.2.2 and 192.168.2.3 according to syslog

Ron

[liviu.gheorghe]

Can you share the config from the router and one of the switches in order to verify if it's normal or not?