Configure Cisco 3560 to send logins to syslog

steven.c.banks · 08-11-2009, 05:42 AM

I have enabled logging in a Cisco 3560 switch, and forwarding of messages to syslog on a Linux server. Messages like line protocol up and down, and config changes, are being sent to syslog OK. What I am not seeing are messages when I log into the switch or change to enable mode.

I made the following config changes in the switch:
SWP01#config t
Enter configuration commands, one per line. End with CNTL/Z.
SWP01(config)#archive
SWP01(config-archive)#log config
SWP01(config-archive-log-cfg)#notify syslog
SWP01(config-archive-log-cfg)#end
SWP01#config t
Enter configuration commands, one per line. End with CNTL/Z.
SWP01(config)#logging 10.50.147.194
SWP01(config)#logging trap debug
SWP01(config)#end

When I enter show logging, I get:
SWP01#show logging
Syslog logging: enabled (0 messages dropped, 23 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
Console logging: level debugging, 244216 messages logged, xml disabled,
filtering disabled
Monitor logging: level debugging, 0 messages logged, xml disabled,
filtering disabled
Buffer logging: level debugging, 244238 messages logged, xml disabled,
filtering disabled
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
File logging: disabled
Trap logging: level debugging, 121155 message lines logged
Logging to 10.50.147.194, 224 message lines logged, xml disabled,
filtering disabled

Is it possible to send login info to syslog, and if so, how? Thanks in advance...

centosboy · 08-11-2009, 08:48 AM

Quote:

Originally Posted by steven.c.banks

I have enabled logging in a Cisco 3560 switch, and forwarding of messages to syslog on a Linux server. Messages like line protocol up and down, and config changes, are being sent to syslog OK. What I am not seeing are messages when I log into the switch or change to enable mode.

I made the following config changes in the switch:
SWP01#config t
Enter configuration commands, one per line. End with CNTL/Z.
SWP01(config)#archive
SWP01(config-archive)#log config
SWP01(config-archive-log-cfg)#notify syslog
SWP01(config-archive-log-cfg)#end
SWP01#config t
Enter configuration commands, one per line. End with CNTL/Z.
SWP01(config)#logging 10.50.147.194
SWP01(config)#logging trap debug
SWP01(config)#end

When I enter show logging, I get:
SWP01#show logging
Syslog logging: enabled (0 messages dropped, 23 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
Console logging: level debugging, 244216 messages logged, xml disabled,
filtering disabled
Monitor logging: level debugging, 0 messages logged, xml disabled,
filtering disabled
Buffer logging: level debugging, 244238 messages logged, xml disabled,
filtering disabled
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
File logging: disabled
Trap logging: level debugging, 121155 message lines logged
Logging to 10.50.147.194, 224 message lines logged, xml disabled,
filtering disabled

Is it possible to send login info to syslog, and if so, how? Thanks in advance...

on syslog server

Code:

SYSLOGD_OPTIONS="-r -m 0"

on router

Code:

service timestamps log datetime localtime
no logging console
no logging monitor
logging 192.x.x.x facility 6

on syslog server in syslog.conf

Code:

local6.*                                                /var/log/cisco.log

then restart syslog

centosboy · 08-12-2009, 02:03 PM

any joy???

steven.c.banks · 08-13-2009, 02:06 PM

sorry - we've had production problems today - will try it tomorrow...