Configuring Cisco Devices to Use a Syslog Server
Most Cisco devices use the syslog protocol to manage system logs and alerts. But unlike their PC and server counterparts, Cisco devices lack large internal storage space for storing these logs. To overcome this limitation, Cisco devices offer the following two options:
- Internal buffer— The device's operating system allocates a small part of memory buffers to log the most recent messages. The buffer size is limited to few kilobytes. This option is enabled by default. However, when the device reboots, these syslog messages are lost.
- Syslog— Use a UNIX-style SYSLOG protocol to send messages to an external device for storing. The storage size does not depend on the router's resources and is limited only by the available disk space on the external syslog server. This option is not enabled by default.
TIP
Before configuring a Cisco device to send syslog messages, make sure that it is configured with the right date, time, and time zone. Syslog data would be useless for troubleshooting if it shows the wrong date and time. You should configure all network devices to use NTP. Using NTP ensures a correct and synchronized system clock on all devices within the network. Setting the devices with the accurate time is helpful for event correlation.
To enable syslog functionality in a Cisco network, you must configure the built-in syslog client within the Cisco devices.
Cisco devices use a severity level of warnings through emergencies to generate error messages about software or hardware malfunctions. The debugging level displays the output of debug commands. The Notice level displays interface up or down transitions and system restart messages. The informational level reloads requests and low-process stack messages.
Configuring Cisco Routers for Syslog
To configure a Cisco IOS-based router for sending syslog messages to an external syslog server, follow the steps in Table 4-11 using privileged EXEC mode.
Table 4-11. Configuring Cisco Routers for Syslog
Step | Command | Purpose |
1 | Router# configure terminal | Enters global configuration mode. |
2 | Router(config)# service timestamps type datetime [msec] [localtime] [show-timezone] | Instructs the system to timestamp syslog messages; the options for the type keyword are debug and log. |
3 | Router(config)#logging host | Specifies the syslog server by IP address or host name; you can specify multiple servers. |
4 | Router(config)# logging trap level | Specifies the kind of messages, by severity level, to be sent to the syslog server. The default is informational and lower. The possible values for level are as follows: Emergency: 0
Alert: 1
Critical: 2
Error: 3
Warning: 4
Notice: 5
Informational: 6
Debug: 7 Use the debug level with caution, because it can generate a large amount of syslog traffic in a busy network. |
5 | Router(config)# logging facility facility-type | Specifies the facility level used by the syslog messages; the default is local7. Possible values are local0, local1, local2, local3, local4, local5, local6, and local7. |
6 | Router(config)# End | Returns to privileged EXEC mode. |
7 | Router# show logging | Displays logging configuration. |
Note
When a level is specified in the logging trap level command, the router is configured to send messages with lower severity levels as well. For example, the logging trap warning command configures the router to send all messages with the severity warning, error, critical, and emergency. Similarly, the logging trap debug command causes the router to send all messages to the syslog server. Exercise caution while enabling the debug level. Because the debug process is assigned a high CPU priority, using it in a busy network can cause the router to crash.
Example 4-12 prepares a Cisco router to send syslog messages at facility local3. Also, the router will only send messages with a severity of warning or higher. The syslog server is on a machine with an IP address of 192.168.0.30.
Example 4-12. Router Configuration for Syslog
Router-Dallas#
Router-Dallas#config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router-Dallas(config)#logging 192.168.0.30
Router-Dallas(config)#service timestamps debug datetime localtime show-timezone
msec
Router-Dallas(config)#service timestamps log datetime localtime show-timezone msec
Router-Dallas(config)#logging facility local3
Router-Dallas(config)#logging trap warning
Router-Dallas(config)#end
Router-Dallas#show logging
Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)
Console logging: level debugging, 79 messages logged
Monitor logging: level debugging, 0 messages logged
Buffer logging: disabled
Trap logging: level warnings, 80 message lines logged
Logging to 192.168.0.30, 57 message lines logged
Configuring a Cisco Switch for Syslog
To configure a Cisco CatOS-based switch for sending syslog messages to an external syslog server, use the privileged EXEC mode commands shown in Table 4-12.
Table 4-12. Configuring a Cisco Switch for Syslog
Step | Command | Purpose |
1 | Switch>(enable) set logging timestamp {enable | disable} | Configures the system to timestamp messages. |
2 | Switch>(enable) set logging server ip-address | Specifies the IP address of the syslog server; a maximum of three servers can be specified. |
3 | Switch>(enable) set logging server severity server_severity_level | Limits messages that are logged to the syslog servers by severity level. |
4 | Switch>(enable) set logging server facility server_facility_parameter | Specifies the facility level that would be used in the message. The default is local7. Apart from the standard facility names listed in Table 4-1, Cisco Catalyst switches use facility names that are specific to the switch. The following facility levels generate syslog messages with fixed severity levels: 5: System, Dynamic-Trunking-Protocol, Port-Aggregation-Protocol, Management, Multilayer Switching 4: CDP, UDLD 2: Other facilities |
5 | Switch>(enable) set logging server enable | Enables the switch to send syslog messages to the syslog servers. |
6 | Switch>(enable) Show logging | Displays the logging configuration. |
Example 4-13 prepares a CatOS-based switch to send syslog messages at facility local4. Also, the switch will only send messages with a severity of warning or higher. The syslog server is on a machine with an IP address of 192.168.0.30.
Example 4-13. CatOS-Based Switch Configuration for Syslog
Console> (enable) set logging timestamp enable
System logging messages timestamp will be enabled.
Console> (enable) set logging server 192.168.0.30
192.168.0.30 added to System logging server table.
Console> (enable) set logging server facility local4
System logging server facility set to
Console> (enable) set logging server severity 4
System logging server severity set to <4>
Console> (enable) set logging server enable
System logging messages will be sent to the configured syslog servers.
Console> (enable) show logging
Logging buffered size: 500
timestamp option: enabled
Logging history size: 1
Logging console: enabled
Logging server: enabled
{192.168.0.30}
server facility: LOCAL4
server severity: warnings(4
Current Logging Session: enabled
Facility Default Severity Current Session Severity
------------- ----------------------- ------------------------
cdp 3 4
drip 2 4
dtp 5 4
dvlan 2 4
earl 2 4
fddi 2 4
filesys 2 4
gvrp 2 4
ip 2 4
kernel 2 4
mcast 2 4
mgmt 5 4
mls 5 4
pagp 5 4
protfilt 2 4
pruning 2 4
radius 2 4
security 2 4
snmp 2 4
spantree 2 4
sys 5 4
tac 2 4
tcp 2 4
telnet 2 4
tftp 2 4
udld 4 4
vmps 2 4
vtp 2 4
0(emergencies) 1(alerts) 2(critical)
3(errors) 4(warnings) 5(notifications)
6(information) 7(debugging)
Console> (enable)
Configuring a Cisco ASA for Syslog >
http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/monitor_syslog.html
You can get a free copy of Syslog server from here
http://www.kiwisyslog.com/free-edition.aspx
Hope it helps!!
Regards
