2960C not sending syslog

[Jess65065]

We are sending syslogs to Auvik. Auvik says none of the Cisco Catalyst 2960C 12pcL are sending logs but other cisco Catalyst models are. I do a show logging history and I see info so it is logging, just not sending it to Auvik. All the switches have the same config. I am not sure why some are working and others are not. 

Logging host x.x.x.x

logging trap 4

Logging on

[balaji.bandi]

if the switch able to ping syslog server ip ?, then Logs should send (is the device and syslog in the same VLAN, any Firewall between ?)

can you post show logging (output here)

May be try  :

logging trap warnings

[Jess65065]

Yes, I can ping the server from the switch. I tried changing it from trap 4 to trap warning but it still is not working in Auvik.  Here is an excerpt from the log. So, it is logging. I don't know, Auvik support says it's the switch, I think it may be Auvik.

(config)# do sh logg his
Syslog History Table:1 maximum table entries,
saving level warnings or higher
49 messages ignored, 0 dropped, 0 recursion drops
14 table entries flushed
SNMP notifications not enabled
entry number 15 : LINK-3-UPDOWN
Interface FastEthernet0/4, changed state to up
timestamp: 7057

[MHM Cisco World]

logging source-interface SVI

first set the source of log packet 
then ping the log server using that IP 
see if it reachable or not. 

[Jess65065]

The syslog server is Auvik which is on a server in the cloud. Other Cisco model switches on the same network can send logs with no issue. It just seems to be the Cisco Catalyst 2960C 12pcL. It's not a firewall issue if other switches are working just fine. 

[balaji.bandi]

thanks for clarify the information :

i would like to see output of show logging (not with history)

is the switch has different routes ? or only 1 route to go out ?

if you have differern route you need to mentioned what interface to go out to syslog server

logging source-interface x/x

[Jess65065]

I figured it out. It has to be something in Auvik. We had interface Vlan 1 shut down for security reasons but unless Interface Vlan 1 is enabled it doesn't work in Auvik. 

[balaji.bandi]

I don't believe that is the reason. since it required IP reachability to reach the Syslog server to send the Logs, check what interface is reachable to your Syslog server, by using ping with source VLAN svi, then make that is as the source.

[MHM Cisco World]

You right I suggest to him same 
in syslog server he add SVI of VLAn1 
then he shut down that way the connection failed.

he success ping server but ping not always give view of connection to Server. (any server)

[Jess65065]

Believe it or not, that is the reason. There turned out to be nothing wrong with the config. Auvik is just a buggy and inconstant platform. For example, traffic insights will work for a firewall on one site and not work for the exact same firewall if you add it to a different site. It says it's not detecting flows on one site while apparently detecting them on another. It's extremely buggy.  I shut interface VLAN one down and Syslog stopped working in Auvik. 

I tried to delete the post since it was not an issue with the switch but it won't let me.