I see in CMX starting version 10.5 that you can enable audit logging and it can be sent to a syslog server.
https://www.cisco.com/c/en/us/td/docs/wireless/mse/10-5/cmx_config/b_cg_cmx105/performing_administrative_tasks.html
Setting Up Audit Logging
You can enable remote logging of system events, and specify which syslog events you want to log and view.
Before you begin
- You must have CMX admin user credentials to modify these settings.
Procedure
| Step 1 | Connect to CMX via SSH. |
| Step 2 | Enter the cmxctl config audit settings command. |
| Step 3 | Respond to the following prompts. Enter selects the prompt default, shown in [brackets]. PromptAction Enable or Disable Remote Syslogging [Enable / Disable] [Enable]: | Choose whether CMX should log system events. Options are Enable or Disable, and defaults to enable. | If logs size goes beyond l gb, drop or overwrite messages? [drop / overwrite] [overwrite] | Select CMX behavior when log size exceeds 1 gigabyte. Options are drop and overwrite, and defaults to overwrite. | Please enter rsyslog port [514]: | Optional. Enter the port number of a remote syslog server if you want to enable remote audit logging. The default is port number 514. | Please enter rsyslog DNS: | Optional. If your system uses a domain name server (DNS) for authentication, enter the DNS address here. There is no default. For example, yoursyslogserver.yourco.com |
A confirmation message displays. Remote Audit Logging = Enabled |
| Step 4 | Select the events you want CMX to log. Yes logs all events. No prompts you to select the event types you want to log, and confirms the update. Show all logs [yes/no] [yes]: no
Enter day [today(1)/yesterday(2)/last week(3)/last month(4)/all(5)] [5]:
Enter event type [MGMT_EVENT(1)/CONN_EVENT(2)/AUTH_EVENT(3)/CONF_EVENT(4)/ALL(5) [5]:
Enter identity [root(1)/admin(2)/all(3)] [3]:
Enter status [success(1)/failure(2)/all(3) [3]:
Settings saved. |
