saving logs to rsyslog server as well

[robertkwild]

Hi all,

Is it possible to save the logs to a rsyslog server as well as saving still locally

Thanks,

Rob

[Jon Marshall · Accepted solution]

Yes it is so you will still have logs in the buffer but you can also send to a syslog server. 

See this link for details - 

https://community.cisco.com/t5/networking-documents/how-to-configure-logging-in-cisco-ios/ta-p/3132434

Jon

[robertkwild]

Great so it's this one

D) Syslog Server logging:

But if I change to syslog server will it still save logs to buffer as well

[Jon Marshall]

Yes, you can still send logs to the buffer as well as to syslog. 

Jon

[robertkwild]

What errors would you trap 0 to 4 or all of them

[robertkwild]

do I have to specify a interface for the syslog

And on my switch it's logging server host as it's a nexus os, is there a how to for this

[Jon Marshall]

You don't necessarily have to specify an interface but it depends on whether you want to use a VRF interface or not. 

What model of switch ? 

Have you tried looking at the configuration guides ? 

Jon

[robertkwild]

---

Nexus 7000

[robertkwild]

)# logging server 172.28.254.254 5 use-vrf VRFname facility local3

But what does use vrf and facility local 3 mean

[Jon Marshall]

The use-vrf bit tells the device to use the specific VRF for logging of messages eg. you may want your syslog messages to go via the management VRF. 

The facility is in effect an identifier to the syslog server so you could log all messages at local3 to a specific log file on your syslog server. 

Jon

[robertkwild]

So I could just do

Logging server ip_of_syslog 0

Logging server ip_of_syslog 1

All the way to 5

Would I need the vrf and specify the interface as I think the above would just be fine wouldn't it

[Jon Marshall]

You should be fine without the VRF and the facility but not sure why you need five entries ? 

Jon

[robertkwild]

Lol

As when I did 0-7 it threw up an error

[Jon Marshall]

You just need to specify the highest level you want and it includes all those below. 

Jon

[robertkwild]

So 5 would do 1 2 3 4 5

What do Cisco switches use for syslog TCP or UDP?