Questions tagged [syslog]
For questions about Syslog on network devices. For instance, you are configuring syslog on your switch or you have have problems with syslog not showing on your router.
43 questions
1
vote
2
answers
829
views
Forward log events to syslog through Fortianalyzer
I'm trying to send my logs from fortianalyzer to graylog, i've set up logforwarding to syslog and i can see some logs that look like this on graylog
<190>logver=702071577 timestamp=1714736929 ...
- 21
0
votes
2
answers
262
views
Can we have two logging source-interface configured on Cisco Switch?
I would like to understand if its possible for us to have two logging source-interface configured on Cisco Switch:
logging source-interface vlan1 (For syslogs)
logging source-interface vlan2 (For ...
- 67
1
vote
1
answer
47
views
Lower level syslogs not sending
We have an MPLS router (ISR4351) in our main data center that reboot itself, causing it and connections to ISR's at other sites to go down. We export our syslogs to a server, and for some reason, none ...
- 11
2
votes
2
answers
422
views
What is the difference between "logging monitor" and "terminal monitor" commands?
I'm currently studying Syslog for CCNA and the course I use mentioned the following command that configures logging of messages to vty lines.
logging monitor level
However, it was then mentioned that ...
- 951
3
votes
1
answer
1k
views
How do I check if a Cisco switch is connected to a SYSLOG server?
We use the Cisco C2960X switch.
Query 1: What does console, monitor, buffer & exception logging mean?
Query 2: Capture logging to 192.168.X.X which means if the switch sends logs to the SYSLOG ...
- 125
1
vote
1
answer
2k
views
Logging discriminator to omit specific log message in Cisco
I'm trying to omit a specific log from being sent to our NMS. We are already using a discriminator to limit the severity of messages to include 5,4,3,2,1,0. I'd also like to add to this so that it ...
- 157
1
vote
0
answers
968
views
SOLVED: Check Point firewall log format through syslog [closed]
I receive logs from a series of Check Point firewalls that I don't manage and they are very thorough, containing every possible information about the communication. They're also formatted like field:&...
- 195
1
vote
1
answer
549
views
Cisco ASA syslog messages, reversed source and destination for outbound communication?
I'm writing my own parser for transforming the syslog output from the ASA firewall into CSV for deeper analysis. What I don't get, is why the "for" and "to" machines are switched ...
- 195
4
votes
1
answer
2k
views
Juniper - minor host 0 /var partition usage is high
Currently running a EX4300 switch. We seem to be low on space on fpc0.
I have already run the request system storage cleanup all-members (only cleaned up a few megabytes).
I have cleared the WTMP file ...
- 41
2
votes
1
answer
785
views
Fortigate 100E user names in syslog
I am monitoring the traffic from a Fortinet Fortigate 100E firewall and I am seeing the user name of a former employee whose local and domain accounts were deleted. I can't ask Fortinet support ...
- 195
3
votes
1
answer
189
views
Log messages not leaving switch after changing source to management port
I reconfigured some of our switches to add an OOB connection from the management port. The below configuration is from a 4500X, but also seeing this on 3850s and 2960s.
After I did this I updated the ...
- 165
1
vote
0
answers
193
views
Meraki and Syslog-NG OSE [closed]
I've been struggling epically to export legible logs from my Meraki devices to a server running Syslog-NG OSE 3.30. No matter what source driver I use on the server, I see errors like this (...
0
votes
1
answer
436
views
can't find notify syslog in cisco sw nexus 3000
in cisco IOS i was used "Configuration Change Notification and Logging"
but in cisco sw-nexuis i can't fine the commend
SW-nex3000(config)# archive
SW-nex3000(config-archive)# log config
...
- 331
0
votes
0
answers
2k
views
Cisco ASA and missing logs to syslog server
I would like to have some help with sending syslogs from a Cisco ASA 5555-X to a syslog server, graylog 3.2.1.
When running the following settings I could see a lot of information in the buffer with ...
- 23
0
votes
1
answer
393
views
Unable to receive logs from a device to our SIEM Syslog server via TCP 514 [closed]
I want to collect logs from a security device (McAfee Email Gateway) to our SIEM Syslog server. This security device can forward logs only via TCP syslog on any port (in our case it is 514). We are ...
2
votes
0
answers
816
views
Cisco nexus spanning-tree logging to syslog
I am trying to send my spanning-tree events to remote syslog but somehow it doesn't work, This is what i have in my config.
N3K# sh run | grep logg
logging level spanning-tree 7
logging server 172.29....
- 4,389
3
votes
3
answers
3k
views
Cisco ASA logging to remote syslog question
I have Cisco ASA and i have setup graylog logging server and i am seeing no logs coming on remote syslog so this is what i did..
Current config:
asa-fw1-010101-2-7/pri/act(config)# show run logging
...
- 4,389
1
vote
0
answers
352
views
Firepower traffic syslogs are sent with (null) instead of the hostname or IP address [closed]
I'm having an issue with Cisco Firepower Syslog, for some reason, I get the Syslog from the FMC with (null) in the place where the sender FTD IP or hostname should be.
I'm using a pure Firepower ...
- 145
2
votes
1
answer
195
views
What is the equivalent of Juniper's " monitor start *logfile* " command for Cisco devices?
I enjoy having the feature of being able to watch real time logs as they occur, but I cannot figure out for the life of me what the Cisco equivalent command for " monitor start logfile " as it is on a ...
- 681
2
votes
2
answers
2k
views
Problems with TCP-Syslog on Cisco devices?
I'm planning to move from UDP-Syslog to TCP-Syslog on some Cisco switches (for example WS-C3560X-24P with 15.0(2)SE9 installed).
But in Cisco documentation I'm not able to find any hint on what ...
- 75
1
vote
1
answer
314
views
2901 Router does not send Syslogs to the Syslog server
We have 2 2901 routers which have BGP and IPsec running with customer devices. we have configured the following commands on the routers for them to send the syslogs to our syslog server.
no logging ...
- 53
1
vote
1
answer
183
views
Log incoming traffic
Is there any way to somehow log all incoming messages for Network devices, like who pinged my switch or who is trying to connect to my switch and what protocol was used?
Is it possible to do it with ...
2
votes
1
answer
2k
views
Send command lines to syslog server
I already can send each Linux command line to my syslog server. Now, I'd like to send each command line inserted onto my Cisco router to syslog server.
Is it possible? If yes, how?
- 123
1
vote
2
answers
1k
views
Global IP sourced on my INSIDE interface to another global IP on OUTSIDE interface
I have a Cisco ASA that gives me some sylogs that I do not understand. My INSIDE interface is where all my private IP addresses reside for the enterprise i work for. My OUTSIDE interface is what has ...
- 403
1
vote
2
answers
787
views
Trigger a syslog message on ASR9k
I want to send a syslog message from ASR9k.
E.g i want to send the message(trigger) "hello world" from my ASR9k. Please suggest the command used for same.
In one of the other blogs, i read:
send log ...
- 905
2
votes
1
answer
1k
views
What are examples of Cisco IOS Syslog level 0 (emergency) messages?
What are examples of Cisco IOS Syslog level 0 (emergency) messages? I have never come across one, nor have I been able to google for one.
- 21
1
vote
1
answer
476
views
How to capture the details of the network traffic by Cisco?
I want to save the details of the network traffic by my Cisco Switch [source IP, dest, protocol...].
Is it possible to enable logging to capture the details of the network traffic by my Cisco in a ...
- 33
2
votes
1
answer
599
views
Cisco Access Control Server ACS
Does anyone know can Cisco ACS be used as syslog server? For collecting logs from cisco devices?
- 812
2
votes
1
answer
2k
views
Cisco EEM pass Syslog message to TCL script
I'm on a Cisco 1811 with IOS 15.1(3)T - yes it's really old, but that probably doesn't matter here.
I have this TCL script that makes an HTTP POST to a destination and i want to pass in ANY Syslog ...
- 221
1
vote
1
answer
145
views
Is it possible to send syslog and SNMP traps to two different addresses concurrently?
I am migrating our NMS and I need to assign a new different IP address to the server I am migrating to. One concern I have is that I want to make sure that all nodes I am monitoring are set up to send ...
- 25
3
votes
4
answers
1k
views
Syslog severity level to 5 + ACL BLOCKED log
I am on a L3 switch C3750 IOS 12.2 and I want to log in the buffer (or just to the syslog server) all severity 5 messages and just the ACL Blocked level 6 messages.
Is there a way to do this ? I've ...
- 180
1
vote
2
answers
3k
views
Cisco ASA syslog filtering
I've got a Cisco ASA forwarding syslog messages to a remote server (which is working great). However, after reviewing the logs, I've noticed a lot of 302013 and 302014 events with one particular ...
- 113
1
vote
1
answer
923
views
Configuring Cisco 4500 series to send DHCP bind info to syslog server?
I am working with a client who needs to be able to view centralized logs for dhcp binds from their multiple 4510's.
Is it possible to send a log of each DHCP binding to their syslog server?
Would ...
1
vote
2
answers
12k
views
How to view old Log messages on Junos
I am currently trying to trace the syslogs on Junos
I ran the "show log" command and the resulting messages I see don't contain that for the date I wish to check. I even ran the command "show log ...
- 129
2
votes
1
answer
2k
views
Which is source IP and destination IP for this Cisco ASA Firewall Log?
Built inbound ICMP connection for faddr 10.1.6.3/1 gaddr 10.24.5.2/0 laddr 10.4.1.2/0
3
votes
1
answer
268
views
Junos syslog filter Cron facility
Is there a way in Junos 12.3R4.6 to filter Cron jobs out of the syslog that is being sent to a host running Kiwi.
- 55
1
vote
0
answers
763
views
PowerConnect 2808 and syslog
I have a pair of Dell PowerConnect 2808 managed switches. I am attempting to enable syslog on them, but not having any luck.
I have searched the web interface, used telnet to log into the CLI ...
- 11
-1
votes
1
answer
1k
views
Dell switch Remote Log output structure
I am looking for information on what each part of a remote log(syslog) entry is from a Dell PowerConnect or Dell N series switch.
I have the following log entry of:
<190> May 15 11:06:19 10....
- 453
5
votes
2
answers
2k
views
Cisco IOS - Is it possible to change severity level of a single syslog message?
On an ASA I can change the severity of a single syslog message by doing this:
logging message 713120 level notifications
Is there a way to do this on a Cisco Router running 15.1 code? I am only ...
- 828
3
votes
1
answer
16k
views
Juniper Filesystem Full
Our Splunk server recently reported an error on one of our Juniper EX 4200s. 1
Aug 4 11:45:16 25SRV01 /kernel: pid 7661 (dd), uid 0 inumber 217 on /var: filesystem full
It appears our /var ...
- 5,529
4
votes
1
answer
3k
views
Log Messages In Juniper MX960
How do I check the Log Messages of Last Month on juniper MX960 Router.
When I am typing the command:
#show log Messages.
It's just showing me the messages for last 15 days. We have two MX960 ...
- 41
4
votes
2
answers
6k
views
Cisco 2960 Syslog - All logs not sent to Server
I have just installed Kiwi Syslog Server and is trying to capture Syslog messages from my Cisco 2960 Switches. Based on the docs online I have created following configuration:
logging 192.168.1.5
...
6
votes
1
answer
2k
views
Rate limit specific Cisco ISR syslog messages
We have a bunch of ISR 2800s on 12.4(25b) that basically are in production until they die. There are no plans to invest money in SmartNET or purchase replacement fans.
We are getting a ton of fan ...
- 3,129