cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1907
Views
0
Helpful
9
Replies

3750 can't log syslog server

samuel0901
Beginner
Beginner

hi,

I configured syslog as below for switch 3750, but syslog server has not received any logging. How to troubleshooting it?

===========================

logging host 10.1.10.11

logging trap informational

logging facility local7

===========================

Thanks!

Samuel

9 Replies 9

Richard Burts
Hall of Fame Guru Hall of Fame Guru
Hall of Fame Guru

Samuel

The first step in troubleshooting would be to verify IP connectivity between the 3750 and the syslog server. Frequently people would start to test this by ping from the 3750 to 10.1.10.11.

If you demonstrate that there is IP connectivity then the next thing that I would do in troubleshooting is to look for access lists on any device along the data path to the syslog server. If there are any access lists then check them to verify that syslog is permitted from the 3750 to the syslog server.

It would also be good to check the syslog server and verify that it is correctly configured to recognize and process facility local7.

Try these things and let us know what you find.

HTH

Rick

HTH

Rick

hi Rick,

ping 10.1.10.11 successful.

syslog works for others router / switch.

thanks!

Samuel

Samuel

If ping works then you have demonstrated IP connectivity and eliminated that as a possible problem (assuming that 10.1.10.11 is the correct address for the syslog server). That leaves the possibility that there might be an access list along the data path from the router to the syslog server that is not permitting the syslog traffic.

Are the routers that are successfully sending to the syslog server also configured with facility local7?

HTH

Rick

HTH

Rick

glen.grant
Advisor
Advisor

Maybe you can post a "show log" .

palukuri77
Beginner
Beginner

You can enable logging by typing, logging on.

Usually we forget enabling logging with this command. I've fixed similar issues with many devices in my previous work environment.

other switch and router logging to syslog server successfuly.

===============================

3750sw>sh log

Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

Console logging: level debugging, 1917 messages logged, xml disabled,

filtering disabled

Monitor logging: level debugging, 0 messages logged, xml disabled,

filtering disabled

Buffer logging: level debugging, 972 messages logged, xml disabled,

filtering disabled

Exception Logging: size (4096 bytes)

Count and timestamp logging messages: disabled

File logging: disabled

Trap logging: level informational, 1920 message lines logged

Logging to 10.1.10.11, 1920 message lines logged, xml disabled,

filtering disabled

Log Buffer (10000 bytes):

:12:27.436: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to down

Mar 5 20:12:29.441: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to up

Mar 5 20:12:34.524: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to down

--More--

=====================================

Are the other devices logging to local7 also?

some yes, some no.

Samuel

I would suggest that you remove the logging facility local7 and see if the behavior changes.

The output of show log that you posted shows pretty clearly that the 3750 is generating log messages to be delivered to the syslog server. I suspect that either there is an issue on the server or else there is something along the data path that is preventing the syslog from being delivered to the server.

HTH

Rick

HTH

Rick
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers