How to configure the ISR 4000 -- 4331 to enable logging to rsyslog facility using the admin console port GigabitEthernet0

[Tom_Bittner1]

Is not working ?  Pleas advise

Executed the following on the ISR 4331.   

ntmhomes#configure t
Enter configuration commands, one per line. End with CNTL/Z.
ntmhomes(config)#service timestamps log datetime localtime
ntmhomes(config)#
ntmhomes(config)#
ntmhomes(config)#logging host 192.168.20.5
ntmhomes(config)#logging trap inform
ntmhomes(config)#logging trap informational
ntmhomes(config)#logging fac
ntmhomes(config)#logging facility local7
ntmhomes(config)#end
ntmhomes#

ntmhomes(config)#logging facility local7
ntmhomes(config)#end

ntmhomes#show logging
Syslog logging: enabled (0 messages dropped, 11 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

Console logging: level debugging, 50 messages logged, xml disabled,
filtering disabled
Monitor logging: level debugging, 0 messages logged, xml disabled,
filtering disabled
Buffer logging: level debugging, 64 messages logged, xml disabled,
filtering disabled
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled

No active filter modules.

Trap logging: level informational, 66 message lines logged
Logging to 192.168.20.5 (udp port 514, audit disabled,
link up),
5 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging Source-Interface: VRF Name:

Log Buffer (4096 bytes):
g to host 192.168.20.5 port 0 CLI Request Triggered
*Jan 9 17:45:27: %SYS-5-CONFIG_I: Configured from memory by console
*Jan 9 17:45:27: %IOSXE_OIR-6-REMSPA: SPA removed from subslot 0/0, interfaces disabled
*Jan 9 17:45:27: %IOSXE_OIR-6-REMSPA: SPA removed from subslot 0/1, interfaces disabled
*Jan 9 17:45:27: %SPA_OIR-6-OFFLINECARD: SPA (ISR4331-3x1GE) offline in subslot 0/0
--More--

[Richard Bradfield]

is 192.168.20.5 reachable from the router?

[Tom_Bittner1]

Yes it is and can ping both ways..

ntmhomes#show ip interface brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0/0 unassigned YES NVRAM down down
GigabitEthernet0/0/1 192.168.10.1 YES NVRAM down down
GigabitEthernet0/0/2 unassigned YES NVRAM administratively down down
GigabitEthernet0 192.168.20.4 YES manual up up

The syslog server is addr 192.168.20.5.  I have tested the syslog server from another remote linux environment using the logger command.  

Also tried to send log from the ISR4331. ntmhomes#send log 4 "TEST syslog local7" local7

one of my issues is locating the correct documentation for this router Cisco 4000 model ISR4331 to verify I set the logging correctly.

New to Cisco stuff.

Thanks

[Richard Bradfield · Accepted solution]

I think  you have to tell the system you are using the management interface

try

logging host 192.168.20.5  vrf Mgmt-intf

see link below section on common gigabit ethernet management tasks

http://www.cisco.com/c/en/us/td/docs/routers/access/4400/software/configuration/guide/isr4400swcfg.pdf

[Tom_Bittner1]

Richard and others,  That-was-it  the vrf Mgmt-intf

Thank-you  so much --  and for the URL link..  :-)) 

Jan 10 22:26:50 mint-32bit logger: ABDEFg
Jan 10 22:36:01 192.168.20.4 64: Jan 10 22:36:00: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 192.168.20.5 port 514 (Mgmt-intf) started - CLI initiated
Jan 10 22:36:08 192.168.20.4 65: Jan 10 22:36:07: %SYS-5-CONFIG_I: Configured from console by vty0 (192.168.20.5)
Jan 10 22:36:39 192.168.20.4 66: Jan 10 22:36:38: %SYS-4-USERLOG_WARNING: Message from tty2(user id: ): "TEST TEST TEST" local7

[Philip D'Ath · Accepted solution]

Is that port in a vrf?  If it is, you might need something like this (where mgmt is the vrf name, change as needed):

logging host 192.168.20.5 vrf mgmt

[Tom_Bittner1]

interface GigabitEthernet0
vrf forwarding Mgmt-intf
ip address 192.168.20.4 255.255.255.0
negotiation auto
!