Send Syslog messages to multiple SYSLOG servers

Hi,
We are have two syslog servers defined, however we notice that the ACS only sends the syslogs to one server and will only send to the other in a failure scenario, which is a standard operation across all platforms. However we have a requirement for the ACS to send syslogs to both servers simultaneously, is there a configuration option for this?
Many Thanks
Leon Noble

You can do the following:
1) Create a remote log target for your syslog server at
System Administration >
Configuration >
Log Configuration >
Remote Log Targets
2) Configure the log categories that should be enabled to eb sent to this log target.
Go to
System Administration >
Configuration >
Log Configuration >
Logging Categories >
GlobalSelect a specifc category and then look at "Remote Syslog Target" tab.
For each category that you want sent to your syslog server select the remote log target in the "
Selected Targets" transfer box
Note that this configuration is hierarchical. So if make configuration for one log category it applies to all subtemding categories. For example if configure
"AAA Audit" then the configuration will apply to the pass and failed attempts categories

Similar Messages

  • Ability to send syslog events to multiple syslog servers - SA540

    Please add the ability to send syslog events to multiple syslog servers in the SA500 Series routers.  I know the functionality is currently in the RV220W because we utilized it.  It would be great if you could configure the syslog servers by event type as well.  For example, being able to send the kernel events to syslog server A, and all other events to syslog server B.

    You can do the following:
    1) Create a remote log target for your syslog server at
    System Administration >
    Configuration >
    Log Configuration >
    Remote Log Targets
    2) Configure the log categories that should be enabled to eb sent to this log target.
    Go to
    System Administration >
    Configuration >
    Log Configuration >
    Logging Categories >
    GlobalSelect a specifc category and then look at "Remote Syslog Target" tab.
    For each category that you want sent to your syslog server select the remote log target in the "
    Selected Targets" transfer box
    Note that this configuration is hierarchical. So if make configuration for one log category it applies to all subtemding categories. For example if configure
    "AAA Audit" then the configuration will apply to the pass and failed attempts categories

  • How can I send a message to multiple contacts using "groups".

    How can I send a message to multiple contacts using "groups".
    It was easy on my sony ericssonn....do i need to download an app?

    There is no group send option like you are looking for.
    To send to a group you have to pick each person you want to send to and send as a group that way. Then don't delete that SMS thread and you can reuse it again later.
    As for an app, well SMS works via your carrier and the OS, not something an App can do unless the app send the data to them (a third party) and then they relay it to the carrier. Do you really want to be sending your SMS to some 3rd party first?

  • Send a message to multiple computers(Not users) from win7/xp command/or scirpt

    Hi Team, is there a way to send a message to multiple windows xp/win7 computers from my win7/xp? 3rd party software,commercial or free, command line,batch or script all welcome. I have a few hundreds of computers, ping-them alive,but I don't know their
    location and user name. I was failed  to push SCCM client to them,some could be in work group or admin$ disabled. so I plan to send a message like " please contact IT department for your pc maintenance by this Friday or this PC will be deleted from
    the corp domain", when the user contact IT, we can RDP or manual install SCCM onsite with user cooperation. The msg.exe can only send to user,instead of computer names. I tried shutdown /m \\pc-name -f -s -t 1200000 "testMessage" but I got alert
    of access denied. though it works if put my local PC name. is there any other way to accomplish this? Many thanks!
    Thanks and best regards, -- KF

    Hi,
    Base on my experience, personally I think solve this case the better method is through your help desk collect the new computer information because consider this: “some
    could be in work group or admin$ disabled”, if there have more workgroup PC, it will always hardly to manage them though a purely technical method.
    About the domain computer, you can refer the following thread I replayed solution, notice a message to users to connect IT department.
    Security Warning Message
    http://social.technet.microsoft.com/Forums/windowsserver/en-US/60c1a896-0996-4e88-ace9-8da2284883f7/security-warning-message?forum=winserverhyperv
    Hope this helps.
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • Important! Can IDS 4.1x Send event messages to a syslog server??

    I know IDS event view and MC can pull the IDS event from IDS sensors and IDSM. But our company is think to collect all the security message in a syslog server. firewall can send syslog to this server. But for IDS and IDSM 4.1, I can't find a way to send the IDS event to syslog server. Is there any way to do that????
    I am really appreciate if you can help me,thanks.

    You comment is an easy statement to make, but IMHO unfair.
    If you look at the Cisco IDS/IPS product line's history, you'll realize that the current RDEP/SDEE communications model is infinitely more secure, while remaining easy to use, than any other method one could propose.
    Initially, the sensors pushed events to the centrally monitoring console via UDP (port 45000), with most of the data in the clear (the source and destination IP address were obfuscated). This is obviously not very safe because, even though the communications were pseudo connection-oriented due to checking by the application daemons at each end, it is possible to intercept and modify the IDS alert to inject false data.
    This same problem exists with stock syslog, since everything goes on the wire as a UDP packet and there is no data obfuscation or encryption what so ever.
    The distinct advantage to the current communications model is the fact that RDEP/SDEE use cryptography to protect your IDS/IPS alerts, and that is also uses a standards-based structure in XML-based forms to pass the data.
    Finally, since Cisco has released an SDK for RDEP/SDEE, and many 3rd party vendors have software that can act as RDEP/SDEE clients, I disagree that you’re stuck with the CiscoWorks-based VMS suite. Besides, you only have to buy the suite if you need to manage more than 5 sensors, but I digress...
    Alex Arndt

  • Sending Text Messages to Multiple Recipients

    Is there a way to send a text message to multiple recipients? I've been trying to figure it out for a while. I feel like this is a feature that apple couldn't have just forgotten! Anybody know?

    Not supported with the iPhone - at the present time anyway with no indication that it will be supported in the future.
    Apple is known for doing research so right, wrong or indifferent, I doubt this is something Apple forgot to include.
    The only thing you can do is provide Apple feedback via the iPhone feedback link.

  • Send text message to multiple people on iPhone 6

    Hi.  Am using an iPhone 6 with iOS version 8.1.2.  I'm unable to send an SMS to multiple contacts/people.  When I compose a new message and add a second person it shifts to MMS mode.  I looked in the manual and under sending a message to a group it only shows iMessage or MMS.  Is this a 'feature' of the iPhone 6?  Have also tried to turn off MMS from the settings but that did not work either.
    The error I get is on the message window it shows "Message Not Delivered" and "Message Send Failure".  Spoke to my mobile provider and they said that there are no issues at there end.
    Please help as this is a feature I use VERY regularly (sending one SMS to many people).
    Thanks.

    See https://discussions.apple.com/message/5519831#5519831

  • Can I send a message to multiple users at once?

    My company has an internal Jabber/XMPP server that we use to communicate as a group. Up until recently, I've been using a Jabber client called Psi (http://psi-im.org/) to connect to our Jabber server and do messaging. However, I recently decided to give Messages a try, since it includes support for the Jabber protocol. It is working great, except for one feature that I can't seem to find. With Psi, I was able to right-click on the heading of a buddy group and choose to send a message to all of the members. With Messages in Yosemite, I get an option to "Send instant message to members," but all that does is pull up my messages window with a random contact from the group selected. I also don't want to start a group chat, I just want to send a broadcast message to the group. Maybe this is just a distinction that Messages doesn't make, but with Psi there was a distinct difference between a message (just a single message, in its own window, sent from one person to one or more other people) and a chat (an ongoing conversation with one or more people, all in the same window).
    Right now when I want to send one of these messages, I quit the Messages app, start Psi, send the broadcast message, quit Psi, and start Messages back up again. I'd like to be able to just use Messages.
    Any thoughts?

    Hi,
    The Yahoo add-on bits in Messages are not worth the code they are written on.
    When it was muted to be coming (pre iChat 6)  we thought it would be added the same way and Jabber was in iChat 3 (later amended to allow the Google Name issue to be circumvented by having A Google Entry) including Group Chats, Direct IM, Video Chats and Audio Chat if only to other iChat/Messages users.
    However this is not the case and it only does 1-1 text chats and can only use actual Yahoo IDs
    8:19 pm      Wednesday; April 22, 2015
    ​  iMac 2.5Ghz i5 2011 (Mavericks 10.9)
     G4/1GhzDual MDD (Leopard 10.5.8)
     MacBookPro 2Gb (Snow Leopard 10.6.8)
     Mac OS X (10.6.8),
     Couple of iPhones and an iPad

  • Send certain syslog messages to different syslog servers

    We have had a security event where we have had to apply certain ACL's to block some traffic.  Some of the blocked traffic is logged to syslog.  We would like to send that log information to different syslog servers, depending on certain pattern matches.
    syslog entries that match pattern xxx = export to syslog server A
    syslog entries that match pattern yyy = export to syslog server B
    Is this possible using something like tcl scripting and EEM?  If so, could someone share some guidance on how this might be accomplished?
    TIA

    Thanks, Joseph.  You answered the question asked...but unfortunately I think that I did not phrase the question correctly.
    Our match criteria will always be mutually exclusive, so it will never match both.  Always one or the other.
    So now that we have this working in it's basic form, now we want to take it a step further and do the following....
    (working) Match criteria A, set Stream 10
    (working) Match criteria B, set Stream 20
    (working) Send stream 10 to syslog Host A
    (working) Send stream 20 to syslog Host B
    (NEW) Send stream 10 AND 20 to syslog Host C
    Unless we have the syntax incorrect, it appears as though we can only send one stream to a given host.  We can configure 'logging host SyslogC filtered stream 10'.  But if we then configure 'logging host SyslogC filtered stream 20', it appears to overwrite the previous configuration, so that we only send Stream 20 to SyslogC, and not Stream 10.
    Is it possible to send multiple streams to a single syslog host?
    Thank you!

  • Send a message to multiple receivers from the same service

    Hi all,
    I registered on SAP community several months ago, I found many good hints and solutions to some of the problems encountered in XI and for which I thank you, but this is the first time I address a question to a common issue, written already about.
    I have a scenario with 1 File FTP sender adapter and 2 Receiver adapters:1 FTP adapter and 1 MAIL adapter. The input message is sent to one of these receiver adapters based on the value taken by a specific field from the input message.The receiver adapters are using the same party and service.
    The requirement is to solve this without using BPM.
    I have read "multiple receiver" issue related blogs and tried to use the standard receiver determination. Thus, I have 1 Sender Agreement, 2 Receiver agreements (one for FTP and one for MAIL), 1 Interface Determinations (with the 2 inbound interfaces and interface mappings corresponding to FTP and MAIL output) and 1 standard Receiver Determination where I added the party and service twice and specified for both the condition. The condition is based on XPath, is correct.
    In sxmb_moni, I get the error: "No receiver could be determined". If I remove one of the conditions, then the output is sent on both receiver adapters, instead of only the one that fulfills the condition.
    Can you please give me some feedback on how to solve this problem? It is rather urgent.
    I have also tried to create 2 Interface Determinations and have 2 Receiver Determinations, each one with the right condition. But I get the same error message.
    Is the problem due to the fact that I don't use 2 different services ?
    If you know how this can be solved without using BPM, please reply.
    Thanks a lot,
    Alina hudea

    > In sxmb_moni, I get the error: "No receiver could be determined". If I remove one of the conditions, then the output is sent on both receiver adapters, instead of only the one that fulfills the condition.
    Hi,
    I think the problem in Receive Determination. As you mentioned when you remove one of the condition then it works..
    What I concluded is, I think while creating your Receiver Determination for multiple receivers you added the receivers by pressing the plus sign and that means you are using mulitiple receivers with "AND" condition, so in this condition when both the condition will be true then only you will get success.
    What you can do is, Just remove one of the receivers and then add it by pressing the "OR" symbol i.e. by pressing this ( [ ] ) symbol and put your conditions as you like.
    I hope what I have concluded is correct.. 
    Regards,
    Sarvesh

  • Sending a message to multiple recipients

    I want to send the same e mail to everyone in my contacts list, Is there any way of selecting all my contacts or do i have to check the box next to everyones name in order to achieve this?
    Regards Peter

    You can not select all contacts. You will need to select them one at a time and add them to the email. If you do this on a regular basis you could set up a Group Contact and drag your contacts into that group.
    You can not have more than 49 contacts in your list or the message will not send.

  • Using 37xx stack switch can I send snmp messages as syslog ?

    In my environment, we are having cisco 37xx stack switches, I want to know is it possible to use the switch config to send snmp traps as syslog messages to the Syslog-server.
    In our case, we are using siem which has the ability to process syslog messages from different networking switches. What specific event I'm after is related to bandwidth utilization of the interface. It would have been great if there was existing syslog-event for exceeded bandwidth or increase in bandwidth beyond certain bps rate. The only place such information can be obtained is from snmp, but the siem station doesn't understand snmp, So I hope there are some setting which allows the conversion of snmp traps to syslog msg to be forwarded to destination.
    Thanks.

    The iPad cannot use your Android phone number at all so it will not in any way be associated with the device or your Apple ID. You will be using your Apple ID email address as your connect address to use Messages. If you want to look at it this way, your iPad/iMessages will be associated with your Apple account/Apple ID, not with the Android phone number.
    Where some users get into problems is if they go from an iPhone number to an Android phone number. That is not what you are doing.

  • Syslog output to multiple destinations

    Hi,
    I have a central syslog server set up. I am only able to either send all syslog messages (from my Solaris 9 client) to the central systog server or store them locally. I want to do both ie., send the messages to the syslog server as well as store them locally. Does anyone know how to do this?
    Regards

    I tried it and it didnt work. Then I found out that there should be tab instead of white space b/w debug and @foo in the example below:
    *.debug @foo
    My config is:
    *.err;kern.debug;daemon.notice;mail.crit /var/adm/messages
    *.err;kern.debug;daemon.notice;mail.crit @foo

  • Syslog messages AP541

    Hi community,
    to find the reason for my connection problems to our network over a AP541N
    I have configured the AP541 to send its syslog messages to a syslog server.
    Now I am looking for a document where I can find informations about the received
    messages.
    For example, what means
    hostapd: wlan0: IEEE 802.11 STA 78:a3:e4:3e:f7:19 deauthed from BSSID 00:21:29:03:18:40 reason 3
    or
    hostapd: wlan0: IEEE 802.11 STA 58:1f:aa:2c:96:4b disassociated from BSSID 00:21:29:03:18:40 reason 8
    Are there documents where the messages are explained ?
    Regards
    Joachim

    Here is a document for cisco wireless access controller client reason codes:
    http://www.cisco.com/en/US/docs/wireless/controller/3.2/configuration/guide/c32err.html
    Client Reason Code…Description…Meaning
    0…noReasonCode…Normal operation.
    1…unspecifiedReason…Client associated but no longer authorized.
    2…previousAuthNotValid…Client associated but not authorized.
    3…deauthenticationLeaving…The access point went offline, deauthenticating the client.
    4…disassociationDueToInactivity…Client session timeout exceeded.
    5…disassociationAPBusy…The access point is busy, performing load balancing, for example.
    6…class2FrameFromNonAuthStation…Client attempted to transfer data before it was authenticated.
    7…class2FrameFromNonAssStation…Client attempted to transfer data before it was associated.
    8…disassociationStaHasLeft…Operating System moved the client to another access point using non-aggressive load balancing.
    9…staReqAssociationWithoutAuth…Client not authorized yet, still attempting to associate with an access point.
    99…missingReasonCode…Client momentarily in an unknown state.

  • Cisco EEM script to detect a sequence of SYSLOG messages

    Hi,
    I am trying to create an EEM "Port-knocking" script which should act upon an ordered sequence of SYSLOG messages. The SYSLOG messages are generated by some "deny tcp any any XXX log STRING" ACLs, applied to the outside interface. 
    Here is what I have already tried:
    ! <------- BEGIN ------->
    ip access-list extended INTERNET
    deny tcp any any eq 1234 log OPEN_SEQUENCE_A
    deny tcp any any eq 1235 log OPEN_SEQUENCE_B
    deny tcp any any eq 1236 log OPEN_SEQUENCE_C
    event manager environment 1ST_MATCH 0
    event manager environment 2ND_MATCH 0
    event manager applet ONE
    event syslog pattern "OPEN_SEQUENCE_A"
    action 1 set 1ST_MATCH "1"
    action 2 syslog msg "DETECTED SEQUENCE A!"
    event manager applet TWO
    event syslog pattern "OPEN_SEQUENCE_B"
    action 1 if $1ST_MATCH eq 1
    action 2 set 2ND_MATCH "1"
    action 3 syslog msg "DETECTED SEQUENCE B!"
    action 4 end
    event manager applet THREE
    event syslog pattern "OPEN_SEQUENCE_C"
    action 1 if $1ST_MATCH eq 1
    action 2 if $2ND_MATCH eq 1
    action 3 syslog msg "DETECTED SEQUENCE C!"
    action 4 syslog msg "PORT KNOCK SUCCESSFUL! UNLOCKING!..."
    action 5 end
    action 6 end
    ! <------- END ------->
    In the above I am somehow trying to "chain" the syslog events, yet I do not seem to be able to pass any information between the applets.
    Any comments are highly appreciated.
    Cheers,
    David

    EEM cannot detect syslog messages that it generates.  If you want to chain together events across multiple applets, use application-specific events.  For example:
    action 2 publish-event sub-system 798 type 1
    event application sub-system 798 type 1
    action 3 publish-event sub-system 798 type 2
    You can also pass up to four arguments as well if you need additional context.

Maybe you are looking for