Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Multiple syslog collectors with one syslog analyzer

I am planning a LMS 2.5 installation and have a question about the following.

I want to use two syslog servers (for redundancy) and have configured my devices accordingly. I have read that you can use the Remote Syslog Collector from RME to pass on the received syslog messages to a syslog analyzer. Now when a device sends its logs to the two syslog collectors and in turn the collectors pass on the syslog to one and the same syslog analyzer, will these messages appear twice in the reports from the analyzer?

4 REPLIES
New Member

Re: Multiple syslog collectors with one syslog analyzer

Good luck, I would just use syslog-ng and this:

http://www.linkdown.org/static_syslogngbrowser_en.html

Red

Re: Multiple syslog collectors with one syslog analyzer

They would show up once. RME will recognize the messages as dulpicates.

New Member

Re: Multiple syslog collectors with one syslog analyzer

Thank you for your quick reply. This really put things in perspective for me.

New Member

Re: Multiple syslog collectors with one syslog analyzer

I have tested the above, but the syslog messages appear twice for the same device in the syslog reports.

I used the following test setup:

server-1 with CS and RME (DCR master)

server-2 with CS and RSC (DCR slave)

Catalyst 3550 with logging set to server-1 and server-2.

Servers are each others peers, and server-2 is subscribed as a syslog collector on server-1.

Am I forgetting something or is it just not possible?

109
Views
11
Helpful
4
Replies