Can we have two logging source-interface configured on Cisco Switch?

Question

I would like to understand if its possible for us to have two logging source-interface configured on Cisco Switch:

1. logging source-interface vlan1 (For syslogs)
2. logging source-interface vlan2 (For onboarding devices)

Answer 1

No. You can have only one source interface statement. If you try to add the second, it will simply overwrite the first.

Answer 2

While Ron is right with the single source interface statement, depending on the network environment, you might be able to pull off a trick.

Still, whichever way you'll turn this, it's going to be very "custom" - just not to say "ugly". See below for a comment

• you need a switch with limited L3 switching capabilities (multiple SVIs, can add static routes)
• the given (security) environment must permit that the switch has more than one SVI
• the given (security) environment must allow for the switch to become a (potential) routing backdoor between the subnets of VLAN 1 and VLAN 2
• there must be an upstream routing device/gateway/router which has (sub)interfaces into these two VLANs 1 and 2

Then you may consider adding a configuration in the style of

vlan 1
 name MYVLAN1

vlan 2
 name MYVLAN2

interface vlan 1
 ip address <ip.of.vlan1.x>

interface vlan 2
 ip address <ip.of.vlan2.x>

ip route <syslog1> 255.255.255.255 vlan1 <ip.of.gw.in.vlan1>
ip route <syslog2> 255.255.255.255 vlan2 <ip.of.gw.in.vlan2>
no ip logging source-interface

Then, the switch should pick the given egress IP interface as source when sending towards syslog1 or syslog2

Depending on what you can do on the given upstream gateway/firewall (some NAT magic) and/or the syslog servers (2nd IP on NIC), both syslog1 and syslog2 might even be the same single syslog server.

So the trick here is to have the switch send syslog to two seemingly different syslog servers.

Comment 1:

Are you possibly looking for a solution that is better solved in a totally different way? (see https://meta.stackexchange.com/questions/66377/what-is-the-xy-problem)

Are you trying to seperate syslog messages based on application case? That is probably best done on the syslog server itself, by message type and keywords.

Comment 2:

Let's assume you achieve the ability to send syslog with two different source addresses by sending to two different syslog servers.

On the switch (on all switches?) you will still need to implement a local filtering logic of what syslog messages to send to which syslog server (see https://community.cisco.com/t5/network-management/send-certain-syslog-messages-to-different-syslog-servers/td-p/2247930 for a few examples.)

This in turn begs the question: Why not implement the same message filtering logic on the syslog server(s), where a proper and fast toolset/framework for message filtering is quite probably built-in? ... see Comment 1, above.