stopped syslog logging?

Unanswered Question
Mar 27th, 2008
User Badges:

To date, I have figured out the root cause. Previously, I was redirecting all log messages from a 2801 to an external syslog server, but only accessed the router through the console. Once I enabled telnet access, all logging to the external server has stopped. Is there something obvious that I am missing?


Thanks for any candor shared.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
omar.elmohri Thu, 03/27/2008 - 04:08
User Badges:

I think that your problem is not related to telnet but there is some problems in configuring logging.


Try to see logging commands on the router, and verify if it's sending the right logging to the right destination.

Richard Burts Thu, 03/27/2008 - 05:22
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

James


I agree that it is unlikely that enabling telnet would impact logging to syslog and that there is probably some other issue or some other change that is impacting logging. A good place to start is with the show log command. In the beginning of the output of that command it provides a good summary of the status of logging. If you would post the output of show log (at least the first screen or two of output) it might help us figure out what the issue is.


Another couple of points would be to verify that you still have IP connectivity to the syslog server (can you ping the syslog server address from the router?). And have you created or changed any access lists on the router?


HTH


Rick

ocicat002 Thu, 03/27/2008 - 05:54
User Badges:

Here's what the router reports:


router#ping 192.168.0.3


Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.0.3, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms

router#show logging

Syslog logging: enabled (1 messages dropped, 2 messages rate-limited,

1717 flushes, 0 overruns, xml disabled, filtering disabled)

Console logging: level debugging, 1743 messages logged, xml disabled,

filtering disabled

Monitor logging: level debugging, 0 messages logged, xml disabled,

filtering disabled

Buffer logging: disabled, xml disabled,

filtering disabled

Logging Exception size (4096 bytes)

Count and timestamp logging messages: disabled


No active filter modules.


Trap logging: level informational, 26 message lines logged

Logging to 192.168.0.3 (udp port 514, audit disabled, link up), 26 message lines logged, xml disabled,

filtering disabled

router#




omar.elmohri Thu, 03/27/2008 - 07:38
User Badges:

All seems well configured.


Any other suggestion for the problem ??

Richard Burts Thu, 03/27/2008 - 08:57
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

James


Thank you for posting the additional information. It does show that the router is attempting to log to a server at 192.168.0.3 and it shows that you do have IP connectivity to that address.


Is there any possibility that there is an issue on the server that is impacting the logging processing?


Is there any other device in the path from the router to the server? If so is it possible that the other device is filtering or interfering with the log messages?


If none of these questions point toward an answer then perhaps I would ask that you post the router config so that we can evaluate whether there is anything in the config that is causing the symptoms.


HTH


Rick

Actions

This Discussion