cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

saving logs to rsyslog server as well

robertkwild
Participant
Participant

Hi all,

Is it possible to save the logs to a rsyslog server as well as saving still locally

Thanks,

Rob

1 ACCEPTED SOLUTION

Accepted Solutions

Jon Marshall
VIP Community Legend VIP Community Legend
VIP Community Legend

 

Yes it is so you will still have logs in the buffer but you can also send to a syslog server. 

 

See this link for details - 

 

https://community.cisco.com/t5/networking-documents/how-to-configure-logging-in-cisco-ios/ta-p/3132434

 

Jon

View solution in original post

20 REPLIES 20

Jon Marshall
VIP Community Legend VIP Community Legend
VIP Community Legend

 

Yes it is so you will still have logs in the buffer but you can also send to a syslog server. 

 

See this link for details - 

 

https://community.cisco.com/t5/networking-documents/how-to-configure-logging-in-cisco-ios/ta-p/3132434

 

Jon

Great so it's this one

D) Syslog Server logging:

But if I change to syslog server will it still save logs to buffer as well

 

Yes, you can still send logs to the buffer as well as to syslog. 

 

Jon

What errors would you trap 0 to 4 or all of them

do I have to specify a interface for the syslog

And on my switch it's logging server host as it's a nexus os, is there a how to for this

 

You don't necessarily have to specify an interface but it depends on whether you want to use a VRF interface or not. 

 

What model of switch ? 

 

Have you tried looking at the configuration guides ? 

 

Jon


Nexus 7000

)# logging server 172.28.254.254 5 use-vrf VRFname facility local3

But what does use vrf and facility local 3 mean

 

The use-vrf bit tells the device to use the specific VRF for logging of messages eg. you may want your syslog messages to go via the management VRF. 

 

The facility is in effect an identifier to the syslog server so you could log all messages at local3 to a specific log file on your syslog server. 

 

Jon

So I could just do

Logging server ip_of_syslog 0

Logging server ip_of_syslog 1

All the way to 5

Would I need the vrf and specify the interface as I think the above would just be fine wouldn't it

 

You should be fine without the VRF and the facility but not sure why you need five entries ? 

 

Jon

Lol

As when I did 0-7 it threw up an error

 

You just need to specify the highest level you want and it includes all those below. 

 

Jon

So 5 would do 1 2 3 4 5

What do Cisco switches use for syslog TCP or UDP?

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: