Thursday, June 12, 2014

Setting up a Syslog server in Ubuntu for Cisco routers/switches

Configuration to be done in Ubuntu server

RSYSLOG is the default logging utility in Ubuntu. Main configuration file for rsyslog is /etc/rsyslog.conf. Make sure that there is a line as follows in the rsyslog.conf file.
$IncludeConfig /etc/rsyslog.d/*.conf
Now make a new file (say cisco.conf) in /etc/rsyslog.d directory.
Add these line to cisco.conf
local7.*    /var/log/cisco/cisco.log
This means that all syslog messages with facility (or tag) as local7 (Local7 is the default tag on all syslog messages from cisco devices) should be logged to cisco.log file at /var/log/cisco directory. So create a folder named cisco at /var/log and a blank document cisco.log inside that folder.
Now just restart rsyslog daemon using the command
sudo service rsyslog restart

Configuration to be done in Cisco device

In the Cisco router/switch whose logs are to be logged in the syslog server, configure the following :

logging Ubuntu_Server_IP
For example,
logging 192.168.2.1
Now all the logs from Cisco device will be logged to Syslog server in the Ubuntu machine. You can see the logs at System Log viewer by opening /var/log/cisco/cisco.log