I have remote syslogging enabled on my 6509 pointing to a Solaris 10 box. The sh log says it is sending log messages, but the solaris box is not getting them.
Here is the config for the 6500 :
logging facility local6
logging trap informational
logging source-interface Loopback0
service timestamps debug datetime localtime
service timestamps log datetime localtime
no logging console
ip nat log translations syslog
Solaris syslog box :
sh log :
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 35 flushes, 0 overruns)
Console logging: disabled
Monitor logging: level debugging, 0 messages logged
Buffer logging: level debugging, 461053 messages logged
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
Trap logging: level informational, 3762 message lines logged
Logging to 18.104.22.168, 3762 message lines logged
Logging to 22.214.171.124, 3762 message lines logged
Logging to 126.96.36.199, 3758 message lines logged
When I sh log, is says that over 3000 lines were logged to the server, but they don't seem to get there. I have checked the ip and can ping it, port 514 is open on the server, permissions were set by the box admin, ect..... I am kinda at a loss what to do next.
Don't change the facility unless your server is using a different facility. Has the config of the server changed? That is, do you still have local6.debug in syslog.conf? Can you put a sniffer on the device side to see if the messages are actually being sent out?