Wired Intelligent Edge

 View Only
  • 1.  Forward 5406Rzl2 Switch events to an external Syslog server

    Posted Aug 12, 2020 09:05 PM

    Good day all. 

    I need to Forward Switch 5406Rzl2 events to an external Syslog server.

    I already have this commands:

    logging my.syslog.server
    logging severity info

     

    but there's no information getting logged on the Syslog server. 

    Can you help me out?

    Thanks a lot.

     



  • 2.  RE: Forward 5406Rzl2 Switch events to an external Syslog server

    Posted Aug 13, 2020 05:47 AM

    Do you have DNS resolving set up if you are using a domain name for the log server?

     

    I just have the command:

    logging 192.168.2.50

    and I see logs coming in.

     

    Can you ping/reach your syslog server on the name that you configured?



  • 3.  RE: Forward 5406Rzl2 Switch events to an external Syslog server

    Posted Aug 13, 2020 09:35 AM
    The thing is I see logs but very few.
    Maybe if I remove the second line?
    Thanks.


  • 4.  RE: Forward 5406Rzl2 Switch events to an external Syslog server

    Posted Aug 14, 2020 04:42 AM

    If you have a stable network, it may be that you don't see so many messages. Port up/down you should see.

     

    When you do a 'show log -r' on the switch, do you see more messages there? What type of messages did you miss? In that show log output you can also see the severity in the first column.

     

     



  • 5.  RE: Forward 5406Rzl2 Switch events to an external Syslog server

    Posted Aug 17, 2020 12:26 PM

    check below commands on switch

     

    # show syslog statistics

    # show debug

    # show running-config | include logging  (in my switch I configured below stats)

    logging 10.0.1x0.xx
    logging 10.0.1x0.xx
    logging severity error
    logging system-module chassis
    logging command

     
     

    community.PNG.jpg

     

     



  • 6.  RE: Forward 5406Rzl2 Switch events to an external Syslog server

    Posted Sep 01, 2020 10:52 PM

    Ok I ran some tests, if I code in: logging severity debug, the switch does not take the command, but If I enter any of the other levels, the command appears like below, but does not send any traffic to Syslog.
    logging 000.000.000.000
    logging severity info

     

    If I just leave this:

    logging 000.000.000.000

    I can see logs coming in but only from the Stacks.

    I am unable to see any traffic coming from the Core Switches.

    Could it be some rule or ACL on the Core Switch Itself.

    Thanks a lot.