I configured syslog as below for switch 3750, but syslog server has not received any logging. How to troubleshooting it?
logging host 10.1.10.11
logging trap informational
logging facility local7
The first step in troubleshooting would be to verify IP connectivity between the 3750 and the syslog server. Frequently people would start to test this by ping from the 3750 to 10.1.10.11.
If you demonstrate that there is IP connectivity then the next thing that I would do in troubleshooting is to look for access lists on any device along the data path to the syslog server. If there are any access lists then check them to verify that syslog is permitted from the 3750 to the syslog server.
It would also be good to check the syslog server and verify that it is correctly configured to recognize and process facility local7.
Try these things and let us know what you find.
If ping works then you have demonstrated IP connectivity and eliminated that as a possible problem (assuming that 10.1.10.11 is the correct address for the syslog server). That leaves the possibility that there might be an access list along the data path from the router to the syslog server that is not permitting the syslog traffic.
Are the routers that are successfully sending to the syslog server also configured with facility local7?
You can enable logging by typing, logging on.
Usually we forget enabling logging with this command. I've fixed similar issues with many devices in my previous work environment.
other switch and router logging to syslog server successfuly.
Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
Console logging: level debugging, 1917 messages logged, xml disabled,
Monitor logging: level debugging, 0 messages logged, xml disabled,
Buffer logging: level debugging, 972 messages logged, xml disabled,
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
File logging: disabled
Trap logging: level informational, 1920 message lines logged
Logging to 10.1.10.11, 1920 message lines logged, xml disabled,
Log Buffer (10000 bytes):
:12:27.436: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to down
Mar 5 20:12:29.441: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to up
Mar 5 20:12:34.524: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to down
I would suggest that you remove the logging facility local7 and see if the behavior changes.
The output of show log that you posted shows pretty clearly that the 3750 is generating log messages to be delivered to the syslog server. I suspect that either there is an issue on the server or else there is something along the data path that is preventing the syslog from being delivered to the server.