Solved: Re: syslog not getting logs from 6509

amit bhatnagar · ‎02-05-2014

Hello , I have configured my 6509 to send logs to syslog server but we dont see any logs coming from it , we are reciving logs on syslog from other network devices but not from this switch below is config if anyone can advise

logging console informational

logging event link-status default

logging source-interface Vlan231 vrf VRF_INFRA

logging host 10.7.2.1 transport udp port 1514

Jon Marshall · ‎02-05-2014

Amit

Can you try and add the VRF to the logging host line eg.

logging host 10.7.2.1 vrf VRF_INFRA ....

Jon

View solution in original post

cadet alain · ‎02-05-2014

Hi,

I see you are sourcing syslog messages from a VRF.

Can you post sh ip route vrf *

Regards

Alain

Don't forget to rate helpful posts.

amit bhatnagar · ‎02-05-2014

Hello Cadet ,

Thanks for reply please find output below .

sh ip route vrf VRF_INFRA

O*E2 0.0.0.0/0 [110/1] via 10.7.0.249, 1w0d, Vlan989

10.0.0.0/8 is variably subnetted, 52 subnets, 6 masks

B 10.6.0.0/29 [200/0] via 207.82.70.210, 6w1d

B 10.6.0.16/29 [200/0] via 207.82.70.210, 6w1d

B 10.6.0.80/28 [200/0] via 207.82.70.210, 6w1d

B 10.6.0.248/29 [200/0] via 207.82.70.210, 6w1d

B 10.6.230.0/24 [200/0] via 207.82.70.210, 6w1d

B 10.6.231.0/24 [200/0] via 207.82.70.210, 6w1d

B 10.6.232.0/24 [200/0] via 207.82.70.210, 6w1d

B 10.6.233.0/24 [200/0] via 207.82.70.210, 6w1d

B 10.6.234.0/24 [200/0] via 207.82.70.210, 6w1d

B 10.6.240.0/22 [200/0] via 207.82.70.210, 6w1d

B 10.6.250.0/24 [200/0] via 207.82.70.210, 6w1d

B 10.6.251.0/24 [200/0] via 207.82.70.210, 6w1d

B 10.6.252.0/24 [200/0] via 207.82.70.210, 6w1d

B 10.6.253.0/24 [200/0] via 207.82.70.210, 6w1d

B 10.6.254.0/24 [200/0] via 207.82.70.210, 6w1d

C 10.7.0.0/29 is directly connected, Vlan990

L 10.7.0.6/32 is directly connected, Vlan990

C 10.7.0.16/29 is directly connected, Vlan992

L 10.7.0.22/32 is directly connected, Vlan992

O 10.7.0.72/29 [110/11] via 10.7.0.249, 1w0d, Vlan989

C 10.7.0.80/28 is directly connected, Vlan994

L 10.7.0.94/32 is directly connected, Vlan994

O 10.7.0.112/29 [110/11] via 10.7.0.249, 1w0d, Vlan989

O 10.7.0.136/29 [110/11] via 10.7.0.249, 1w0d, Vlan989

O 10.7.0.144/29 [110/11] via 10.7.0.249, 1w0d, Vlan989

O 10.7.0.200/29 [110/11] via 10.7.0.249, 1w0d, Vlan989

C 10.7.0.248/29 is directly connected, Vlan989

L 10.7.0.254/32 is directly connected, Vlan989

O 10.7.123.0/24 [110/11] via 10.7.0.249, 1w0d, Vlan989

O 10.7.200.0/27 [110/11] via 10.7.0.249, 1w0d, Vlan989

C 10.7.230.0/24 is directly connected, Vlan230

L 10.7.230.254/32 is directly connected, Vlan230

C 10.7.231.0/24 is directly connected, Vlan231

L 10.7.231.254/32 is directly connected, Vlan231

C 10.7.232.0/24 is directly connected, Vlan232

L 10.7.232.254/32 is directly connected, Vlan232

C 10.7.233.0/24 is directly connected, Vlan233

L 10.7.233.254/32 is directly connected, Vlan233

C 10.7.234.0/24 is directly connected, Vlan234

L 10.7.234.254/32 is directly connected, Vlan234

C 10.7.240.0/22 is directly connected, Vlan240

L 10.7.243.254/32 is directly connected, Vlan240

C 10.7.250.0/24 is directly connected, Vlan250

L 10.7.250.254/32 is directly connected, Vlan250

C 10.7.251.0/24 is directly connected, Vlan251

L 10.7.251.254/32 is directly connected, Vlan251

C 10.7.252.0/24 is directly connected, Vlan252

L 10.7.252.254/32 is directly connected, Vlan252

C 10.7.253.0/24 is directly connected, Vlan253

L 10.7.253.254/32 is directly connected, Vlan253

C 10.7.254.0/24 is directly connected, Vlan254

L 10.7.254.254/32 is directly connected, Vlan254

cadet alain · ‎02-05-2014

What is the output from ping vrf VRF_INFRA 10.7.2.1 so Vlan231 ?

Regards

Alain

Don't forget to rate helpful posts.

amit bhatnagar · ‎02-05-2014

Below is output of ping 10.7.231.1 ,apology in first post i have mentioned 10.7.2.1 its typo mistake correct ip is 10.7.231.1

#ping vrf VRF_INFRA 10.7.231.1 so Vlan231

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.7.231.1, timeout is 2 seconds:

Packet sent with a source address of 10.7.231.254

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms

cadet alain · ‎02-05-2014

Hi,

logging host 10.7.2.1 transport udp port 1514 the default port is 514, is this a typo ?

Regards

Alain

Don't forget to rate helpful posts.

amit bhatnagar · ‎02-05-2014

hello Alain ,

1514 is correct port its the one on which syslog is listening , and other devices are getting logged .

Regards

Amit

Jon Marshall · ‎02-05-2014

Amit

Can you try and add the VRF to the logging host line eg.

logging host 10.7.2.1 vrf VRF_INFRA ....

Jon

cadet alain · ‎02-05-2014

Hi jon,

Good catch I think , can we still use the source-interface command in this case ?

Regards

Alain

Don't forget to rate helpful posts.

Jon Marshall · ‎02-05-2014

Hi Alain

can we still use the source-interface command in this case ?

As far as i know yes you can because you still may want to specificy which IP the syslog messages are seen from.

Jon

cadet alain · ‎02-05-2014

Hi Jon,

I ask this because there is this output here:

http://www.cisco.com/en/US/docs/ios/12_2sr/12_2sra/feature/guide/srvrfslg.html

"You cannot specify a source address for VRF system logging messages. The VRF Aware System Message Logging feature uses the VRF interface address as the source address for all VRF-aware system logging messages. "

My question is is it still mandatory here if you enable vrf aware logging or will it impact the behaviour of logging or will it simply be ignored ?

Regards

Alain

Don't forget to rate helpful posts.

Jon Marshall · ‎02-05-2014

Alain

Ahh, so it was a trick question

Seriously though to be completely honest i am not sure. The document does seem to suggest you cannot use both although this is for 12.2SR which is not used on 6500s so it may be slightly different behaviour on the 6500.

Jon

cadet alain · ‎02-05-2014

Jon,

No trick question , just wanted to have your opinion as you are far more experienced than I am

To be honest I didn't look for other IOS code and other platforms and maybe I should have before asking

Regards

Alain

Don't forget to rate helpful posts.

Jon Marshall · ‎02-05-2014

Alain

No problem, it was only said in jest

The problem with documentation is that sometimes not all docs are updated so you end up referring to one IOS release and you have to assume it applies to other releases that support the same feature.

So i would just assume you can't use it but would try testing it anyway to see what happens.

Jon

cadet alain · ‎02-05-2014

Jon,

no worry I understood it was a jest

Thanks for your replies.

Regards.

Alain

Don't forget to rate helpful posts.