3750 can't log syslog server

[samuel0901]

hi,

I configured syslog as below for switch 3750, but syslog server has not received any logging. How to troubleshooting it?

===========================

logging host 10.1.10.11

logging trap informational

logging facility local7

===========================

Thanks!

Samuel

[Richard Burts]

Samuel

The first step in troubleshooting would be to verify IP connectivity between the 3750 and the syslog server. Frequently people would start to test this by ping from the 3750 to 10.1.10.11.

If you demonstrate that there is IP connectivity then the next thing that I would do in troubleshooting is to look for access lists on any device along the data path to the syslog server. If there are any access lists then check them to verify that syslog is permitted from the 3750 to the syslog server.

It would also be good to check the syslog server and verify that it is correctly configured to recognize and process facility local7.

Try these things and let us know what you find.

HTH

Rick

[samuel0901]

hi Rick,

ping 10.1.10.11 successful.

syslog works for others router / switch.

thanks!

Samuel

[Richard Burts]

Samuel

If ping works then you have demonstrated IP connectivity and eliminated that as a possible problem (assuming that 10.1.10.11 is the correct address for the syslog server). That leaves the possibility that there might be an access list along the data path from the router to the syslog server that is not permitting the syslog traffic.

Are the routers that are successfully sending to the syslog server also configured with facility local7?

HTH

Rick

[glen.grant]

Maybe you can post a "show log" .

[palukuri77]

You can enable logging by typing, logging on.

Usually we forget enabling logging with this command. I've fixed similar issues with many devices in my previous work environment.

[samuel0901]

other switch and router logging to syslog server successfuly.

===============================

3750sw>sh log

Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

Console logging: level debugging, 1917 messages logged, xml disabled,

filtering disabled

Monitor logging: level debugging, 0 messages logged, xml disabled,

filtering disabled

Buffer logging: level debugging, 972 messages logged, xml disabled,

filtering disabled

Exception Logging: size (4096 bytes)

Count and timestamp logging messages: disabled

File logging: disabled

Trap logging: level informational, 1920 message lines logged

Logging to 10.1.10.11, 1920 message lines logged, xml disabled,

filtering disabled

Log Buffer (10000 bytes):

:12:27.436: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to down

Mar 5 20:12:29.441: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to up

Mar 5 20:12:34.524: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to down

--More--

=====================================

[ahmednaas]

Are the other devices logging to local7 also?

[samuel0901]

some yes, some no.

[Richard Burts]

Samuel

I would suggest that you remove the logging facility local7 and see if the behavior changes.

The output of show log that you posted shows pretty clearly that the 3750 is generating log messages to be delivered to the syslog server. I suspect that either there is an issue on the server or else there is something along the data path that is preventing the syslog from being delivered to the server.

HTH

Rick