stopped syslog logging?

Unanswered Question
Mar 27th, 2008

To date, I have figured out the root cause. Previously, I was redirecting all log messages from a 2801 to an external syslog server, but only accessed the router through the console. Once I enabled telnet access, all logging to the external server has stopped. Is there something obvious that I am missing?

Thanks for any candor shared.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
omar.elmohri Thu, 03/27/2008 - 04:08

I think that your problem is not related to telnet but there is some problems in configuring logging.

Try to see logging commands on the router, and verify if it's sending the right logging to the right destination.

Richard Burts Thu, 03/27/2008 - 05:22

James

I agree that it is unlikely that enabling telnet would impact logging to syslog and that there is probably some other issue or some other change that is impacting logging. A good place to start is with the show log command. In the beginning of the output of that command it provides a good summary of the status of logging. If you would post the output of show log (at least the first screen or two of output) it might help us figure out what the issue is.

Another couple of points would be to verify that you still have IP connectivity to the syslog server (can you ping the syslog server address from the router?). And have you created or changed any access lists on the router?

HTH

Rick

ocicat002 Thu, 03/27/2008 - 05:54

Here's what the router reports:

router#ping 192.168.0.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.0.3, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms

router#show logging

Syslog logging: enabled (1 messages dropped, 2 messages rate-limited,

1717 flushes, 0 overruns, xml disabled, filtering disabled)

Console logging: level debugging, 1743 messages logged, xml disabled,

filtering disabled

Monitor logging: level debugging, 0 messages logged, xml disabled,

filtering disabled

Buffer logging: disabled, xml disabled,

filtering disabled

Logging Exception size (4096 bytes)

Count and timestamp logging messages: disabled

No active filter modules.

Trap logging: level informational, 26 message lines logged

Logging to 192.168.0.3 (udp port 514, audit disabled, link up), 26 message lines logged, xml disabled,

filtering disabled

router#

Richard Burts Thu, 03/27/2008 - 08:57

James

Thank you for posting the additional information. It does show that the router is attempting to log to a server at 192.168.0.3 and it shows that you do have IP connectivity to that address.

Is there any possibility that there is an issue on the server that is impacting the logging processing?

Is there any other device in the path from the router to the server? If so is it possible that the other device is filtering or interfering with the log messages?

If none of these questions point toward an answer then perhaps I would ask that you post the router config so that we can evaluate whether there is anything in the config that is causing the symptoms.

HTH

Rick

Actions

This Discussion