I reconfigured some of our switches to add an OOB connection from the management port. The below configuration is from a 4500X, but also seeing this on 3850s and 2960s.

After I did this I updated the logging to our external log server to source from the management port. Prior to updating this, logging was working from the in-band management address. After changing it to source from the management port, log messages are no longer reaching the logging server.

logging source-interface FastEthernet1 vrf mgmtVrf
logging host transport udp port 10023

I am able to ping the logging server from the management VRF:

ping vrf mgmtVrf
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

show log indicates that it is trying to send messages, and the count is increasing:

Trap logging: level informational, 238587 message lines logged
        Logging to  (udp port 10023, audit disabled,
              link up),
              15351 message lines logged,

I ran a span session at the switch that this management port is plugged in to, and there were no packets destined to the logging server. So it seems that the log messages are never leaving the initial switch out the management port.

What else can I check to see why logging has stopped working?

  • 1
    Perhaps your span session isn't working correctly. Is there filtering on the logging server?
    – Ron Trunk
    Jun 22 at 19:54
  • 1
    I was able to see other management traffic going to/from the switch, so the span session appeared to be working correctly. There is some filtering on the server but I triple checked that it was allowing from the IPs that it needed to allow from. Jun 22 at 21:41

Set the VRF on the host entry. Your VRF should also be defined on the management interface itself.

Please issue the commands:

no logging host transport udp port 10023
logging host vrf mgmtVrf transport udp port 10023
  • 2
    Jesse, specifying the vrf in the logging host command is what worked. I am now getting log messages to the logging server via the management port. The switch prevents me from specifying logging source fast 1 without also specifying the vrf because fast 1 is in a vrf: "Interface FastEthernet1's vrf mgmtVrf does not match with cfg vrf" Jun 22 at 21:31
  • @JohnMoffitt. Okay. As long as you got it working with the other command. I edited my answer to remove that other part. If my answer solved your issue, please mark is as accepted so this doesn't keep coming up as unresolved.
    – Jesse P.
    Jun 22 at 21:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.