I reconfigured some of our switches to add an OOB connection from the management port. The below configuration is from a 4500X, but also seeing this on 3850s and 2960s.
After I did this I updated the logging to our external log server to source from the management port. Prior to updating this, logging was working from the in-band management address. After changing it to source from the management port, log messages are no longer reaching the logging server.
logging source-interface FastEthernet1 vrf mgmtVrf logging host 10.10.10.10 transport udp port 10023
I am able to ping the logging server from the management VRF:
ping vrf mgmtVrf 10.10.10.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.10.10.10, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
show log indicates that it is trying to send messages, and the count is increasing:
... Trap logging: level informational, 238587 message lines logged Logging to 10.10.10.10 (udp port 10023, audit disabled, link up), 15351 message lines logged,
I ran a span session at the switch that this management port is plugged in to, and there were no packets destined to the logging server. So it seems that the log messages are never leaving the initial switch out the management port.
What else can I check to see why logging has stopped working?