hi all,

I configured remote syslog server in order to log my routers logging messages. It will log all the Interface UP/Down Notifications.

But It didnt log the authentication (either successful or failure) messages once I log to remote router.

How can I enable this ? My syslog.conf configuration look like this(attached).

How can I modify this to acheive my requirement.

your responses are highly.

Attached Files

syslog-conf.txt (1.0 KB, 21 views)

your config is not attached.

our responses are highly what?

all traffic hitting the box should be logged, so it's more than likely that the logs do not exist, you've not said anything about what routers you're using, so commenting on their config is impossible. You can use tcpdump to watch incoming traffic and see if it exists and also what facility / priority it has in case something is slipping through the cracks, but that's unlikely.

hi all,

now I attached the config. Im using cisco routers. I confogigured following in my router

logging <syslog-server-ip>
logging source fa 0/0
logging trap notifications

I directeg all logging messages to /logs/cisco/cis file. Logs created except the loging authenication messages.

sample log file
Apr 1 13:48:52 [IP] 94855: Apr 1 13:48:51: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/0.91 (not half duplex), with 899F Ethernet0 (half duplex).
Apr 1 13:48:54 [IP] 113419: 21w0d: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/9, changed state to down
Apr 1 13:48:54 [IP] 113420: 21w0d: %LINK-3-UPDOWN: Interface GigabitEthernet0/9, changed state to down
Apr 1 13:49:07 [IP] 113421: 21w0d: %LINK-3-UPDOWN: Interface GigabitEthernet0/9, changed state to up

If a user try to log using incorrect username/password it should log in this file. But at the moment it's not happenning.

again, you need to show that the message is reaching the box, if it's not you can't blame the box itself can you?

I didnt get your point. Whats the fault with my configuration ?

you clearly don't get my point as I keep saying it's probably not your configuration at all. is the traffic hitting the box in the first place?

Have you tried the following:

login on-success log
login on-failure log

tnx davis .I got working this by doing your configuration.

That's great news, glad it work out for you.