03-02-2007 06:10 PM - edited 03-05-2019 02:40 PM
hi,
I configured syslog as below for switch 3750, but syslog server has not received any logging. How to troubleshooting it?
===========================
logging host 10.1.10.11
logging trap informational
logging facility local7
===========================
Thanks!
Samuel
03-02-2007 07:30 PM
Samuel
The first step in troubleshooting would be to verify IP connectivity between the 3750 and the syslog server. Frequently people would start to test this by ping from the 3750 to 10.1.10.11.
If you demonstrate that there is IP connectivity then the next thing that I would do in troubleshooting is to look for access lists on any device along the data path to the syslog server. If there are any access lists then check them to verify that syslog is permitted from the 3750 to the syslog server.
It would also be good to check the syslog server and verify that it is correctly configured to recognize and process facility local7.
Try these things and let us know what you find.
HTH
Rick
03-03-2007 12:10 AM
hi Rick,
ping 10.1.10.11 successful.
syslog works for others router / switch.
thanks!
Samuel
03-03-2007 10:07 AM
Samuel
If ping works then you have demonstrated IP connectivity and eliminated that as a possible problem (assuming that 10.1.10.11 is the correct address for the syslog server). That leaves the possibility that there might be an access list along the data path from the router to the syslog server that is not permitting the syslog traffic.
Are the routers that are successfully sending to the syslog server also configured with facility local7?
HTH
Rick
03-03-2007 10:52 AM
Maybe you can post a "show log" .
03-06-2007 05:50 AM
You can enable logging by typing, logging on.
Usually we forget enabling logging with this command. I've fixed similar issues with many devices in my previous work environment.
03-17-2007 05:04 AM
other switch and router logging to syslog server successfuly.
===============================
3750sw>sh log
Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
Console logging: level debugging, 1917 messages logged, xml disabled,
filtering disabled
Monitor logging: level debugging, 0 messages logged, xml disabled,
filtering disabled
Buffer logging: level debugging, 972 messages logged, xml disabled,
filtering disabled
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
File logging: disabled
Trap logging: level informational, 1920 message lines logged
Logging to 10.1.10.11, 1920 message lines logged, xml disabled,
filtering disabled
Log Buffer (10000 bytes):
:12:27.436: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to down
Mar 5 20:12:29.441: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to up
Mar 5 20:12:34.524: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to down
--More--
=====================================
03-17-2007 09:57 AM
Are the other devices logging to local7 also?
03-17-2007 10:41 AM
some yes, some no.
03-17-2007 03:56 PM
Samuel
I would suggest that you remove the logging facility local7 and see if the behavior changes.
The output of show log that you posted shows pretty clearly that the 3750 is generating log messages to be delivered to the syslog server. I suspect that either there is an issue on the server or else there is something along the data path that is preventing the syslog from being delivered to the server.
HTH
Rick
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide