23/01/2023, 20:01 networking - syslog-ng not receiving logs from Cisco Router - Ask Ubuntu

syslog-ng not receiving logs from Cisco Router

Asked 5 years, 8 months ago Modified 5 years, 8 months ago Viewed 837 times

Greetings of the day!

1 I have configured syslog-ng with a very simple configuration which is as follows-
I have made direct changes on - /etc/syslog-ng/syslog-ng.conf
And here is what I have added - source s_net { udp(ip(192.168.145.140) port(514)); };
destination path { file("/var/log/dev.log"); }; filter ipaddr { host( "192.168.122.205" ); }; log {
source ( s_net ); filter( ipaddr ); destination ( path ); };
192.168.145.140 - Is the Ubuntu 16.04/syslog server 192.168.122.205 - Is the Cisco Router
There is reach ability- Router1#ping 192.168.145.140
Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.145.140,
timeout is 2 seconds: !!!!!
distro@ubuntu:/home$ ping 192.168.122.205 PING 192.168.122.205 (192.168.122.205)
56(84) bytes of data. 64 bytes from 192.168.122.205: icmp_seq=1 ttl=254 time=4.03 ms
64 bytes from 192.168.122.205: icmp_seq=2 ttl=254 time=10.2 ms 64 bytes from
192.168.122.205: icmp_seq=3 ttl=254 time=7.50 ms ^C --- 192.168.122.205 ping statistics
--- 3 packets transmitted, 3 received, 0% packet loss, time 2004ms
distro@ubuntu:/home$ sudo netstat -telnup | grep syslog udp 0 0 192.168.145.140:514
0.0.0.0:* 0 98403 5570/syslog-ng

Router is configured fine-

logging buffered 4096 logging trap debugging logging facility syslog logging source-
interface FastEthernet0/0 logging 192.168.145.140 logging synchronous logging
synchronous logging synchronous level all ntp logging
Router1#show log Trap logging: level debugging, 404 message lines logged Logging to
192.168.145.140 (udp port 514, audit disabled, authentication disabled, encryption disabled,
link up), 164 message lines logged,
But the issue I am not able to see any logs.Nor there are any files created - /var/log/dev.log
Also there is another issue were when I wanted to test the syslog connectivity
https://askubuntu.com/questions/919164/syslog-ng-not-receiving-logs-from-cisco-router 1/2
23/01/2023, 20:01 networking - syslog-ng not receiving logs from Cisco Router - Ask Ubuntu

distro@ubuntu:/home$ telnet 192.168.145.140 514 Trying 192.168.145.140... telnet: Unable

to connect to remote host: Connection refused
As you can imagine the connectivity fails from Router telnetting into the syslog server.
There is no firewall configuration -
distro@ubuntu:/home$ sudo iptables -L Chain INPUT (policy ACCEPT) target prot opt
source destination
Chain FORWARD (policy ACCEPT) target prot opt source destination
Chain OUTPUT (policy ACCEPT) target prot opt source destination
Kindly advice.
networking syslog cisco

Share Improve this question Follow asked May 26, 2017 at 15:24
CCIE_LINUX
41 3

Hi, Try removing the filter from the log path and see if messages start arriving. Also, you can try to
start syslog-ng with the -Fevd command-line options to see if it reports a specific error. Cisco
devices tend to send messages that are not syslog compliant, so you might have some parsing
errors. If that's the case, let me know. – Robert Fekete May 29, 2017 at 12:30

https://askubuntu.com/questions/919164/syslog-ng-not-receiving-logs-from-cisco-router 2/2