Syslog

[glmrenard]

Hello,

I have a little problem with ciscoworks 2000, I don't receive syslog message from one of my switch and this switch has exactly the same config thant the other. But, when I type "show logging" I see syslog message.

Ciscoworks doesn't see anything on this switch, why ?

switch configuration for the two 4506

________________

logging 172.25.4.30

________________

RG1(4506) : show log:

-> 192.168.132.255(137), 6 packets

May 22 12:07:59: %SEC-6-IPACCESSLOGP: list in_132 denied udp 192.168.132.8(138) -> 192.168.132.255(138), 2 packets

SWRG1#

RG2(4506) : show log

May 22 12:09:15: %SEC-6-IPACCESSLOGP: list in_132 denied udp 192.168.132.12(138) -> 192.168.132.255(138), 1 packet

May 22 12:10:03: %SEC-6-IPACCESSLOGP: list in_128 permitted tcp 172.25.12.48(1681) -> 192.168.128.4(23), 1 packet

SWRG2>

But in cisco works, I dont't see anything from the RG1

I want ALL syslog message are sent to Ciscoworks for the two swith, please help....

Thanks in advance

Guillaume

[milan.kulik]

Hi,

I remember similar problem:

After changing the hostname and IP address on my switch it was still sending syslog messages with the original hostname and IP address. I had to reboot the switch.

Isn't that your problem?

Regards,

Milan

[glmrenard]

Hello,

No, I don't think so. Maybe I will reboot the switch, but not now :)

I have to precise that there is a tunnel between these switch

============

interface Port-channel1

switchport

switchport trunk encapsulation dot1q

switchport mode trunk

!

interface GigabitEthernet1/1

description SWRG2 1/1

switchport trunk encapsulation dot1q

switchport mode trunk

channel-group 1 mode on

!

interface GigabitEthernet1/2

description SWRG2 1/2

switchport trunk encapsulation dot1q

switchport mode trunk

channel-group 1 mode on

============

Thanks

Guillaume

[greg.t.smith · Accepted solution]

First, make sure that all of the settings are the same in the configs including Logging server IP, severity, facility.

Next, make sure that both devices are in Resource Manager Essentials.

Next, run the Unexpected Device report under Syslog Analysis. This will show all the devices that are sending logging messages to CiscoWorks but are not configured in RME.

If you see the logging messages in that report - your device may be managed by a different IP address than the one it is receiving the logging messages from. Perform a reverse NSLOOKUP to determine the IP that CiscoWorks uses for the device. Set the logging source on the device to that IP using the command: logging source-interface interface#

Hope this helps.

Good Luck.