4

I have just installed Kiwi Syslog Server and is trying to capture Syslog messages from my Cisco 2960 Switches. Based on the docs online I have created following configuration:

logging 192.168.1.5
logging trap 7
logging facility local7
service timestamps debug datetime localtime msec year 
service sequence-numbers 
archive
    log config
        logging enable
        logging size 1000
        exit
    exit
clock timezone IST +5 30 
logging source-interface vlan 1

Now I dont see all the logs being sent to the Server. Here is the result of Show logging:

G01#sh logging 
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.



No Inactive Message Discriminator.


    Console logging: level debugging, 1228 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging:  level debugging, 1228 messages logged, xml disabled,
                     filtering disabled
    Exception Logging: size (4096 bytes)
    Count and timestamp logging messages: disabled
    File logging: disabled
    Persistent logging: disabled

No active filter modules.

    Trap logging: level debugging, 1232 message lines logged
        Logging to 192.168.1.5  (udp port 514,  audit disabled,
              authentication disabled, encryption disabled, link up),
              14 message lines logged, 
              0 message lines rate-limited, 
              0 message lines dropped-by-MD, 
              xml disabled, sequence number disabled
              filtering disabled

Log Buffer (4096 bytes):

Could someone please tell me why even though 1232 message lines are logged by the trap only 14 are sent to the server itself?

My key goals are to ensure that any interface up/down, any kind of debug information any kind of configuration changes are all logged and sent to Syslog server.

Please advice,

Thanks.

  • can you ping your server from the switch and is there a firewall active on the server. – Jens Link Jun 3 '14 at 15:40
  • Pings work, no firewalls, switch and Syslog server are on same subnet. Strange thing is 14 messages got logged, but not the remaining logs. The syslog server is a brand new installation, so is there any clause that only fresher logs get sent to Syslog server? – gokul varma nk Jun 3 '14 at 15:48
  • How many log entries have been created since this new installation? Logs entries are sent at the time of creation. It will not send old entries to the syslog server. – YLearn Jun 3 '14 at 16:16
  • Thanks Ylearn, so that must be it. All the logs after connecting to Syslog server have been sent, so I guess there is no way to send the old logs to be synced to the Syslog server. – gokul varma nk Jun 3 '14 at 16:42
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 20:43
6

Is this output from after a reboot? You may have 1232 lines since you rebooted the device, but only 14 messages since you setup the syslog server. The switch won't send any old messages, just newly-generated ones.

| improve this answer | |
3

When logging to an external or syslog server, only new log entries are sent to the server. Old log entries will not be sent.

You probably only have 14 log messages because that is all that have been generated since you installed the syslog server.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.