Trap messages to syslog server cisco WS-C4503 - 3750x

All,
I have issue with respect to SNMP trap , below is the histroy
SW1 -- trunk port Gi 2/11 ( old switch )
SW2- trunk port Gi 1/0/2 ( old switch)
recently SW2 got replaced
SW1 -- trunk port Gi 2/11 ( old switch )
SW2- trunk port Gi 1/1/2 ( new switch)
SYSLOG server still recieving trap message saying that trunk port between SW1 2/11 to SW2 Gi 1/0/2 is down , however SW2 trunk currently on the new port Gi 1/1/2 . bit wondering on this . the new switch Gi 1/0/2 which is currently access port and it is not connected to any host machine since installed and no logging port flap information ( sh logging output) is something need to be done at switches to clear log message at server . please advice
below is the port configuration
SW1 ( OLD)
interface GigabitEthernet2/11
description *******
switchport mode trunk
switchport nonegotiate
SW1#sh run | in trap
logging trap debugging
snmp-server enable traps snmp linkdown linkup coldstart warmstart
snmp-server enable traps envmon fan shutdown supply temperature
snmp-server enable traps hsrp
snmp-server enable traps mac-notification change move threshold
SW2 ( NEW switch )
interface GigabitEthernet1/0/2
switchport mode access
switchport nonegotiate
load-interval 30
spanning-tree portfast
spanning-tree bpduguard enable
spanning-tree guard root
SW2#sh run | in trap
snmp-server enable traps snmp authentication
snmp-server enable traps config
snmp-server enable traps hsrp
snmp-server enable traps bridge newroot topologychange
snmp-server enable traps stpx inconsistency root-inconsistency loop-inconsistency
snmp-server enable traps vtp
snmp-server enable traps vlancreate
snmp-server enable traps vlandelete
snmp-server enable traps flash insertion removal
snmp-server enable traps envmon fan shutdown supply temperature status
snmp-server enable traps vlan-membership

Hi
I feel this link will be of some help to u in configuring different severity levels for different facilities available.
http://www.cisco.com/en/US/partner/products/hw/switches/ps663/products_configuration_guide_chapter09186a00800d81c8.html
By default for abnormal temp conditions u will get logs in the syslog server if u have already pointed the logs to the syslog server..
regds

Similar Messages

SEND ALL MESSAGES TO SYSLOG SERVER

HI, I WANT SEE ALL INFORMATIONS THAT WHO CONNECT TO ROUTER OR SWITCH AND WHICH COMMAND USE DURING CONNECTION, AT THE SYSLOG SERVER. FOR EXAMPLE :"SH RUN", "SH INT FA0/0", "ENABLE", "CONF T".....
HOW CAN I DO THAT?
THX

HI,
I used that config over my routers
logging buffered 4096 informatinal
logging trap 5
archive--->for take config changes to syslog server
log config
logging enable
logging size 200
notify syslog
hidekeys
logging origin-id hostname
logging 10.10.1.119
logging 128.1.14.193
logging source-interface FastEthernet0/0.10
I see log messages on syslog server, but ı want see also failed authentications on syslog server,
I think I have to use these conmmands
login block-for 60 attempts 3 within 60
login delay 1
login on-failure log every 3
login on-success log
but these commands do not support on my routers, I use "c2800nm-adventerprisek9-mz.124-11.T4.bin"
Which IOS does support these commands?
THX
Gürcan Başural
Assistant Manager
IT Systems and Network Management Department
IT and Operations Division
T. +90 212 225 0500 - 1308 F. +90 212 225 0526
@. [email protected] W. http://www.atbank.com.tr
Bu e-posta ve muhtemel eklerinde verilen bilgiler kişiye özel ve gizli olup, yalnızca mesajda belirlenen alıcı ile ilgilidir. Bu mesajda bulunan tüm fikir ve görüşler ve ekindeki dosyalar sadece adres sahip(ler)ine ait olup, Arap Türk Bankası A.Ş. hiçbir şekilde sorumlu tutulamaz. Şirketimiz mesajın ve bilgilerinin size değişikliğe uğrayarak veya geç ulaşmasından, bütünlüğünün ve gizliliğinin korunamamasından, virüs içermesinden ve bilgisayar sisteminize verebileceği herhangi bir zarardan sorumlu tutulamaz.
This message and attachments are confidential and intended solely for the individual(s) stated in this message. This e-mail is not intended to impose nor shall it be construed as imposing any legally binding obligation upon Arap Türk Bankası A.Ş. and/or any of its subsidiaries or associated companies. Neither Arap Türk Bankası A.Ş. nor any of its subsidiaries or associated companies gives any representation or warranty as to the accuracy or completeness of the contents of this e-mail. Arap Türk Bankası A.Ş. shall not be held liable to any person resulting from the use of any information contained in this e-mail and shall not be liable to any person who acts or omits to do anything in reliance upon it.

ACS appliance1120 ACS 4.2.1.15 syslog message to syslog server

Hi All ,
I am using ACS 1120 appliance running ACS version 4.2.1.15 , I am pointing out all syslog message to my external syslog server (passed authentication , failed authentication , database replication , administration aduit ,tacacs accounting ) , but i could recieve only passed authentication log message to my external log server , no other log message except passed authentication is pushed to my external log server , But i could see failed attempts , database replication,administrtation audit log message locally on my acs appliance as CSV file ,
Syslog server configuration is configured under all logging (passed , failed , administration , tacacs accounting ) , but i am surprise to see only passed authentication logg is sent out from acs appliance , Is there any patch to be installed for logg message scripting ?? , please advise ..

Refer the link : https://supportforums.cisco.com/discussion/11513026/migrating-acs-420-421
you can directly upgrade from 4.2.0.124 to 5.6 : http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-6/user/guide/acsuserguide/migrate.html#98379

No Messages from Syslog Server

We have ASA 5550 (ver. 8.0.4). We configured the ASA so that messages can be sent to Syslog server. We were able to ping the Syslog server from the ASA. However, no messages are sent to the Syslog server. The Syslog server has been configured to accept messages from the ASA. Below is part of the config of the ASA. Thanks.
logging enable
logging list Events level errors class auth
logging list Events level errors class session
logging list Events level errors class sys
logging console errors
logging asdm informational
logging mail errors
logging from-address <A HREF="mailto:[email protected]">[email protected]</A>
logging recipient-address <A HREF="mailto:[email protected]">[email protected]</A> level errors
logging host Inside XXX.X.X.XXX

Are you using a Kiwi Syslog server? What are you trying to do with the logs? If you're trying to do some level of analytics and run reports based on the syslog messages, there are a bunch of useful tools available for this:
http://www.kiwisyslog.com/kb/info:-log-reporting-and-analysis/

Logging of commands on syslog server (Cisco Nexus 7010)

Please help.
How to set up logging of commands on syslog server ? (cisco nexus 7010)

Hi Igor
Nexus has internal accounting log: sh accouting log
But it can be sent only to the accounting server, not to a syslog server.
If you want - you man manually export it to some log.
HTH,
Alex

Configuration required in Cat 4006 to forward errors to syslog server

Hi,
I have setup a Kiwi syslog server. I want to configure in my Cat 4006 switch to forward the following messages to my syslog server
1. configuration changes
2. Vlan creation /modification
3. Power supply failures/module failures/temperature
4. When the processor utlization exceeds more than 75% , it should send a alert message to syslog server
5. Switch restart
6. Trap for any changes in Uplink ports only. There are 4 uplinks to other Switches from 4006. If any problem with these ports (uplink), it should send message to syslog server , not for all ports
Thanks in advance
Raju

Hi
I feel this link will be of some help to u in configuring different severity levels for different facilities available.
http://www.cisco.com/en/US/partner/products/hw/switches/ps663/products_configuration_guide_chapter09186a00800d81c8.html
By default for abnormal temp conditions u will get logs in the syslog server if u have already pointed the logs to the syslog server..
regds

Capturing port description information to syslog serve

Hello All,
I want to know if there is a way to capture (logging level?) port-description information on Cisco devices (i.e. 4510, 2960, etc.) as it sends traps to a syslog server.
For example, the IP of of my 4510 is 10.1.150.5, I have global snmp (RO) configured. If port gi5/3 goes down (err-disabled)...the trap is sent to an external syslog server (i.e. Syslogd). The entry on the syslog shows the source IP (10.1.150.5) and interface (gi5/3). But I would like to also see the port-description of gi5/3.
Thoughts? Many thanks in advance.
- K. Lee

If your platforms have EEM on them, the attached EEM policy may work for you.
HTH,
Dan

Can Cisco Prime Infra 2.1 work as syslog server

Hello all,
Customer want Cisco Prime Infra 2.1 to work as syslog server. they want to query text in syslog and get raw log file from Cisco Prime Infra. but when i see in user interface. I think that it cannot query and search text in syslog. but i am not sure whether we can get raw log file per devices from Cisco Prime Infra. Can anyone know about this.?
thanks
sompoj

Hi Sompoj,
In the prime infrastructure Syslogs are directly read from udp port 514 and then filtered
, the non SEV1 and SEV2 syslogs will be dropped and will not be entered into db . The
syslog messages will not be saved into log files .
Thanks-
Afroz
****Ratings Encourages Contributors ****

Cisco Prime syslog server

Where are syslogs stored, if I point my devices to Cisco Prime acting as my syslog server? I am running 2.0
thanks, Jerry

Hi ,
As of now , this feature is not available , I mean PI will not work as syslog server.
Syslog messages received by PI from managed devices are found under Monitor > Alarms and Events > Syslogs
as you are using PI 2.2 , you will be able to see all device syslog messages (0-7 severity)
That display will show you up to 200,000 messages at a time.
Check the below link for other related details proved by Marvin :
https://supportforums.cisco.com/discussion/12486126/cisco-prime-syslog-functionality#sthash.Wbj2a3lj.dpuf
Thanks-
Afroz
***Ratings Encourages Contributors ****

Important! Can IDS 4.1x Send event messages to a syslog server??

I know IDS event view and MC can pull the IDS event from IDS sensors and IDSM. But our company is think to collect all the security message in a syslog server. firewall can send syslog to this server. But for IDS and IDSM 4.1, I can't find a way to send the IDS event to syslog server. Is there any way to do that????
I am really appreciate if you can help me,thanks.

You comment is an easy statement to make, but IMHO unfair.
If you look at the Cisco IDS/IPS product line's history, you'll realize that the current RDEP/SDEE communications model is infinitely more secure, while remaining easy to use, than any other method one could propose.
Initially, the sensors pushed events to the centrally monitoring console via UDP (port 45000), with most of the data in the clear (the source and destination IP address were obfuscated). This is obviously not very safe because, even though the communications were pseudo connection-oriented due to checking by the application daemons at each end, it is possible to intercept and modify the IDS alert to inject false data.
This same problem exists with stock syslog, since everything goes on the wire as a UDP packet and there is no data obfuscation or encryption what so ever.
The distinct advantage to the current communications model is the fact that RDEP/SDEE use cryptography to protect your IDS/IPS alerts, and that is also uses a standards-based structure in XML-based forms to pass the data.
Finally, since Cisco has released an SDK for RDEP/SDEE, and many 3rd party vendors have software that can act as RDEP/SDEE clients, I disagree that youre stuck with the CiscoWorks-based VMS suite. Besides, you only have to buy the suite if you need to manage more than 5 sensors, but I digress...
Alex Arndt

Cisco PI syslog server configuration

Hi all,
I need to configure the PI as syslog server and get the log file from the PI to read it ??
how can I do it, please advice
thanks in advance

Hi,
Which prime version are you using ?
Here is what Prime 2.1 user guide says
http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/2-1/user/guide/pi_ug/alarms.html#pgfId-1054572
Prime Infrastructure logs all emergency, alert, and critical messages generated by all devices that are managed by Prime Infrastructure.
Prime Infrastructure also logs all SNMP messages and syslogs it receives. To view syslogs, choose Operate > Alarms & Events , then click the Syslogs tab.
Syslog Predefined Filters
Prime Infrastructure uses the following syslog filters:
Severity 0 and 1
Severity 2
Environmental Monitor
Memory Allocation Failure
Catalyst Integrated Security Features
Cisco IOS Firewall Denial of Service
Read this thread as well, it talks about tweak this setting, but it could leads to fill up your prime disk space quickly.
https://supportforums.cisco.com/discussion/11645481/prime-infrastructure-12-syslog
HTH
Rasika
**** Pls rate all useful responses ****

Configure Cisco Works as a Syslog Server ???

Hi Friends,
Is it possible to configure syslog server in Cisco Works,if possible please share the steps need to be configutreed..

Syslog server in ciscoworks is pretty simple.
> Configure device to send syslog to ciscoworks
> Subscribe Syslog Collector in Ciscoworks
> Set correct filters and Generate report to see syslogs.
When Syslog is recived in Syslog.log(win)/Syslog_info(sol/lin) Syslog collector pics syslog message from that flat log/text file and send it to Syslog Db after filtering messages as per filter settings.
Subscribing Syslog Collector however differs with LMS version. Please see:
LMS 3.x :
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_resource_manager_essentials/4.3/user/guide/syslog.html#wp1123042
LMS 4.x:
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.2/user/guide/admin/collection.html#wp1059476
Syslog Documents for Ciscoworks:
http://docwiki.cisco.com/wiki/Network_Management_Configuration_Example_for_Ciscoworks_LMS_Syslog_Configuration_via_GUI
http://www.cisco.com/en/US/products/sw/cscowork/ps2073/products_tech_note09186a00800a7275.shtml
-Thanks

Cannot receive message from ASA 5505 b syslog server?

Dear All,
I have some problem on Syslog server. i was enable command as below for syslog server:
logging enable
logging timestamp
logging buffer-size 409600
logging console critical
logging monitor debugging
logging buffered warnings
logging trap informational
logging history informational
logging asdm informational
logging host inside 192.168.7.10 6/0
logging debug-trace
But my syslog server did not receive message from ASA 5505....
I don't what is going on?
Do you have any command on this?
Best Regards,
Rechard

Why did you put the /0 after the logging host command?
Just put logging host inside
Have a look at this lnk:
http://ciscosystems.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00805a2e04.shtml
Please rate if helpful.
Regards
Farrukh

Sending traps about rouge AP to syslog server

Hi
I am looking to have a syslog server capture traps from a 5508 running 7.6.110
I don't want to turn logging to max just capture similar trap as one below into a syslog server
Rogue AP: aa:aa:aa:aa:aa:aa detected on Base Radio MAC: bb:bb:bb:bb:bb:bb
Interface no: 0(802.11n(2.4 GHz)) Channel: 13 RSSI: -93 SNR: 0
Classification: unclassified, State: Alert, RuleClassified : N,
Severity Score: 0, RuleName: N.A. ,Classified AP MAC: 00:00:00:00:00:00 ,
Classified RSSI: 0
have adjusted the syslog level and facility but believe i have not hit the correct balance
any assistance would be appreciated

Hi.
SNMP traps are sent to a SNMP trap collector. not to a syslog server.
syslog messages are sent to a syslog server.
I think that message above is under the level "errors" (not pretty sure). if you config the level to be "errors" you'll receive all syslog messages under that category.
Regarding SNMP traps, make sure that under the trap control that the rogue AP traps are checked so they are sent to the SNMP collector.
Regards,
Amjad

Syslog server for Monitoring Cisco devices

I am looking for Syslog server to log all logs from Cisco devices. We have more than 800 cisco devices. Can anyone tell me what syslog server should i use to log these files.
Thank you.

Has anyone used the Cisco recommendation of Buliding Scalable Syslog Solutions?
http://www.cisco.com/en/US/technologies/collateral/tk869/tk769/white_paper_c11-557812.html#wp9000318
I used this in another organaztion and we were very successful, we currenlty use Netcool that feeds from a syslog and we get several non-actionable alarms and it's very time consuming for 13,000 devices. I would only like to alert on 0-5 Cisco Syslog messages. Below is the response from my Netcool Administrator (What are your thoughts?):
From my Netcool Administrator:
Regarding, using the Cisco syslog severity for alert control, I feel that is not the best way to control the work in Netcool.
1. -- Cisco is not consistent with the use of this value.
    Examples:
        In this case the important message is the lower severity alert: I would consider the BGP-3-NOTIFICATION of a 6 level of Informational
        Aug 4 03:10:01 rtgara02r01m04-lb0.us.bank-dns.com 001458: Aug 4 03:10:01: %BGP-5-ADJCHANGE: neighbor 10.93.69.106 Down BGP Notification sent
        Aug 4 03:10:02 rtgara02r01m04-lb0.us.bank-dns.com 001459: Aug 4 03:10:01: %BGP-3-NOTIFICATION: sent to neighbor 10.93.69.106 4/0 (hold time expired) 0 bytes
        This one is near the top level of serverity per Cisco but not all that severe in reality, further this syslog has a bug where the threshold is not even exceeded
        %ENVMON-1-CPU_WARNING_OVERTEMP: Critical Warning: CPU temperature 107C exceeds threshold 110C. Please resolve system cooling immediately to prevent system damage
        This one is reporting a standard condition:
        %ILPOWER-5-POWER_GRANTED: Interface Fa0/24: Power granted
        Here is an example of a 1 where the voice group says that nothing is wrong:
        Aug 4 13:08:42 rtgcaa75u01-01.sw.us.bank-dns.com 047489: Aug 4 11:08:41: %IVR-1-APP_PARALLEL_INVALID_LIST: Call terminated. Huntgroup \'1\' does not contain enough valid SIP end-points to proceed with a parallel call.

Trap messages to syslog server cisco WS-C4503 - 3750x

Similar Messages

Maybe you are looking for