Hello everyone !! I deceided to use graylog in the enterprise i’m working because of its powerful functions. I configured a cisco router to send its logs to my graylog server. I tested both the Raw/Plaintext and the Syslog udp input but i am not receiving any logs. I checked the in/out msg/s but th…

Check firewall-cmd and semanage so that the port you use for receiving rsyslog input is open. When you are certain the port is open, try tcpdump on the interface to see if anything comes to the graylog server at all.

How did you install Graylog? How did you configure the Syslog UDP and the Raw/Plaintext UDP inputs? How did you configure the Cisco appliances? How did you configure rsyslog? Make sure to read https://github.com/Graylog2/graylog-guide-syslog-linux/blob/master/README.md .

Hi @jjfotso I can confirm that the overall solution works as I’m collecting syslog from ton of Cisco gear so the question is whether there’s a fundamental issue with rsyslog accepting anything at all. Did you inject a test syslog message into Graylog to see whether it will show up? Here’s my templa…

Hello jtkarvo I checked the firewall and it’s disabled. The SELinux is also disabled. I used tcpdump to listen to the interface and i’m able to see a traffic coming from my router which name is RCISCOLOG. But i’m not receiving anything in my rsyslog file. I do receive something in my graylog inpu…

[image] Can not receive Cisco logs Graylog Central (peer support) How did you install Graylog? How did you configure the Syslog UDP and the Raw/Plaintext UDP inputs? How did you configure the Cisco appliances? How did you configure rsyslog? Make sure to read https://git…

Hello jochen I installed graylog as it’s stipulated in the documentation. Here is how i configured the Syslog UDP [image] Here is how i configured my router logging trap debugging logging facility local5 logging source-interface FastEthernet0/0 logging 192.168.60.1 Here is how i configur…

Hello guys !! I did the test of receiving logs on a virtual environnment (VMware and GNS3) before implementing that on a real network. The test was successfull. I was able to receive logs from a Cisco router into graylog and in a file on CentOS. In graylog i used that Syslog UDP input that i sent…

hi, your configuration of rsyslog tells that the port number is 5140 but according t the switch log line it tries to sen to port 514. Seems you have a mismatch in port numbers.

@jjfotso oops I might have missed a line which doesn’t show up in show run for some reason. In global config mode enter “logging on”; I think it might be that simple :slight_smile:

I finally succeeded. The problem was the firewall and i disabled it by entering these commands: systemctl disable firewalld systemctl stop firewalld

Can not receive Cisco logs

Graylog Central (peer support)

Topic		Replies	Views
Graylog is not picking Cisco switch logs Graylog Central (peer support)	2	3756	April 2, 2017
Log Cisco Messages Graylog Central (peer support)	19	13615	November 29, 2019
RSYSLOG UDP works but not SYSLOG TCP Graylog Central (peer support)	8	12743	September 22, 2017
CISCO CSR Syslog Graylog Central (peer support)	2	507	October 16, 2018
Graylog recive message but not save Graylog Central (peer support)	4	1834	April 13, 2017

Can not receive Cisco logs

Related topics