Logging and SNMP

[mountainbiker619]

Have CISCO 4000 series router and what to send logging to my computer that has KIWI Syslog Servive manager installed.I configured logging to the host Ip of my computer and enabled SNMP-Server pointed at my workstation. Command SHOW SNMP shows logging to the correct Ip, but shows 0 sent. Where did I go wrong? Do I need to enable anything on my interfaces?

R/

David

[globalnettech]

Hello David,

check if you have enabled the Kiwi Syslog Daemon to listen on port 162. You can do this by selecting File | Setup | Inputs | SNMP from the Kiwi Syslog Daemon main menu.

From the SNMP properties window, check the option "Listen for SNMP traps".

Regards,

GNT

[mountainbiker619]

I am getting them now, just was not patient enough. But I am getting flooded with "excessive modem control changes". I researched this and it says to check the serial interface cable. I disconnect and reconnected the cable with no change. Any way to disable this Notice? Also, is there a way to send logging msg's when a packet has been droped by an ACL?

R/

David

[globalnettech]

Hello David,

the 'logging trap' global command gives you the option to define eight (0-7) levels of messages to be sent to your syslog server. Not sure what severity level your specific error message belongs to, but I would guess that setting the level to 3 (errors) would keep them from getting sent to your syslog server.

As with regard to the access list, try and add the 'log' keyword to the end of any 'deny' statement in your access list, or add an explicity deny (deny ip any any log) to the end of your access list.

You might have to change the trap level in order to allow the ACL-generated messages to be sent to your syslog server...

HTH,

GNT

[mountainbiker619]

GNT,

Thank you for the helpfull info. Found Error Message Logging Levels on Google search.

I have another issue for you, my Snort and Ethereal programs are not seeing inbound packets. Through testing with a dumb hub between router and ATM switch we found problem to be at the router. So what setting in the router would allow it to make inbound packets appear invisible?

R/

David