# Cisco switch logs

**URL:** <https://community.graylog.org/t/cisco-switch-logs/10656>\
**Category:** Graylog Central (peer support)\
**Created:** [June 2, 2019, 12:01am UTC](https://community.graylog.org/t/cisco-switch-logs/10656 "2019-06-02T00:01:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Labidi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/labidi/32/5597_2.png) [@Labidi](https://community.graylog.org/u/Labidi)\
**Post date:** [June 2, 2019, 12:01am UTC](https://community.graylog.org/t/cisco-switch-logs/10656/1 "2019-06-02T00:01:37Z")

</div>

Hello everyone,

I collect the logs of a Cisco switch with Graylog, to have the switch logs, I made a script " **Prerouting - iptables - graylog- 514-1514**" (Redirect Graylog traffic) …in graylog I put “input” under port 514, it didn’t work, the switch sends the logs on port 514, so it requires a redirect…now i can have switch logs but why graylog does not accept logs under port 514 in the case of switch cisco. Please I want to know exactly why ??

Thanks.

---

<div class="post-metadata">

**Author:** ![benvanstaveren](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/benvanstaveren/32/3398_2.png) [@benvanstaveren](https://community.graylog.org/u/benvanstaveren)\
**Post date:** [June 3, 2019, 10:39am UTC](https://community.graylog.org/t/cisco-switch-logs/10656/2 "2019-06-03T10:39:26Z")

</div>

Because port 514 is a privileged port and requires Graylog to run as root in order to open that port up with it’s listener.

If you want to know exactly why, then I suggest you Google a bit and find answers that way instead of demanding answers here 😉

---

<div class="post-metadata">

**Author:** ![Labidi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/labidi/32/5597_2.png) [@Labidi](https://community.graylog.org/u/Labidi)\
**Post date:** [June 3, 2019, 10:58am UTC](https://community.graylog.org/t/cisco-switch-logs/10656/3 "2019-06-03T10:58:03Z")

</div>

Graylog is bind to privileged ports **(anything \<1024)** 👏 but about switch cisco i have no exact information is what the switch sends his logs by default through port 514 ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 17, 2019, 10:58am UTC](https://community.graylog.org/t/cisco-switch-logs/10656/4 "2019-06-17T10:58:03Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.