Cisco Remote Syslog on different UDP/TCP Port,, possible?

[DotTest37]

I have a couple of Cisco 2960's sending syslog messages to a remote syslog-ng on port 514 (standard).

I need to set another Swtich so it sends traffic to the same syslog server but on another UDP port (such as 714),, is that possible,?

I cannot find the option on the documentation.

Thanks!

[Peter Paluch]

Hello,

Try using:

logging host X.X.X.X transport udp port 714

Best regards,

Peter

[DotTest37]

Hello Peter

Switch(config)#logging 192.168.200.223 transport udp port 714

                                       ^

% Invalid input detected at '^' marker.

According to the documentation, the command is >  logging host <

where host  is the destination IP.

Doestn say anything about ports or protocol.  :-(

[Reza Sharifi]

Hi,

The command Peter provided is correct.

see example:

Switch(config)#logging host 192.168.200.223 transport udp port 174

Switch(config)#

can you provide a model number for your 2960?

HTH

[DotTest37]

cisco WS-C2960G-48TC-L (PowerPC405) processor (revision C0) with 61440K/4088K bytes of memory

C2960 Software (C2960-LANBASE-M), Version 12.2(35)SE5

Maybe my IOS is too old.

[Reza Sharifi]

In the global can you do an l and ? to see the options?

Switch(config)#l?

l2protocol-tunnel  lacp   li-view  license

line               link   lldp     location

logging            login 

Switch(config)#l

[DotTest37]

returns:

lacp  line  link  logging  login

[Reza Sharifi · Accepted solution]

It appear that the 2960s do not support this command

here the reference guide for 12.2(55)

http://cavalcante.us/Cisco/Catalyst%202960%20and%202960%20-S%20Switch%20Command%20Reference,%20Release%2012.2%2855%29SE.pdf

HTH

[DotTest37]

:-(  Thats what I was afraid of.

I didnt see it on the Documentation.

I might have then to try another trick, maybe a Middleware Syslog, with some filters and then a forward to another port.

Thats a shame it doesnt support it.

[Clayton Dukes]

You can accomplish what you need by filtering on the receiving end for that one switch. Here's a link to a very good whitepaper on syslog management:

http://www.cisco.com/en/US/technologies/collateral/tk869/tk769/white_paper_c11-557812.html

You can easily set up syslog-ng or rsyslog to filter out messages from that device.