Enabling Logging on an ASR from a source port

[LADONNA EVANS-DUHART]

I have a Cisco ASR 1001.  I am trying to send traffic from g0 to a switch that picks up all my logging traffic.

Below is my config.  What am I missing.  I am trying to send traffic to device 10.10.23.17. I want to make sure that ll traffic get to 10.10.23.17.

Thanks in advance!

logging trap debugging

logging facility local1

logging host 10.10.23.17

ip route vrf Mgmt-intf 0.0.0.0 0.0.0.0 10.10.88.1

[Collin Clark]

Can you ping the syslog server from the management IP?

ping vrf Mgmt-intf 10.10.23.17

[LADONNA EVANS-DUHART]

Syslog logging: enabled (0 messages dropped, 11 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

    Console logging: disabled

    Monitor logging: disabled

    Buffer logging:  disabled, xml disabled,

                    filtering disabled

    Exception Logging: size (4096 bytes)

    Count and timestamp logging messages: disabled

    Persistent logging: disabled

No active filter modules.

    Trap logging: level debugging, 553 message lines logged

        Logging to 10.10.23.17  (udp port 514, audit disabled,

              link up),

              121 message lines logged,

              0 message lines rate-limited,

              0 message lines dropped-by-MD,

              xml disabled, sequence number disabled

              filtering disabled

        Logging to 10.10.89.74  (udp port 514, audit disabled,

              link up),

              2 message lines logged,

              0 message lines rate-limited,

              0 message lines dropped-by-MD,

              xml disabled, sequence number disabled

              filtering disabled

        Logging Source-Interface:       VRF Name:

        GigabitEthernet0                Mgmt-intf

[Collin Clark]

Thanks. Messages are being sent so that part looks OK. Is there a reason you're logging at facility local1?

[LADONNA EVANS-DUHART]

Yes I am.

[Collin Clark]

Can you post the results of a show log? Just the part up to the actual log entries.

[Rolf Fischer]

Could you check it the logging host command has a vrf-option:

logging host vrf Mgmt-intf 10.10.23.17

http://www.cisco.com/en/US/docs/ios/netmgmt/command/reference/nm_09.html#wp1082864

http://www.cisco.com/en/US/docs/routers/asr1000/configuration/guide/chassis/Management_Ethernet.html#wp1059051

HTH

Rolf

[Collin Clark]

Good catch Rolf. This is IOS-XE so the command is a little different.

logging source-interface GigabitEthernet0 vrf Mgmt-intf

[Rolf Fischer]

Thanks Collin. Those little differences make our life much more interesting, right? ;-)

[ThinMan]

Hi All, 

I have the same issue too. so I am trying to configure syslog via management interface.

1. I can ping the Syslog server via management interface

2. I have the below config

logging source-interface GigabitEthernet0 vrf Mgmt-intf
logging host 10.x.x.x vrf Mgmt-intf

3. I see the below for show logging but none received in Syslog server

Oct 9 07:08:42.485: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 10.x.x.x port 514 (Mgmt-intf) started - reconnection
*Oct 9 07:10:52.529: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (10.2.3.1)

[Kyujin Choi]

 I have a same issue. However, I found an interesting stuff. After the configuration, I was able to see syslogs from Solarwind Orion, but not from Kiwi syslog server (I am pulling to two servers). If you don't see any log shipped from the ASR, try it to a different server (or app) to make sure you can see the log. I believe each syslog server has own syslog format to accept. If you don't have additional app, just do packet capture to confirm it. 

[ThinMan]

Thanks Kyujin. I actually figured out the issue, it was the syslog server that wasnt processing the logs. Like you mentioned, I had do a packet capture. so for me above configuration actually worked!