Syslog device preparation

Forwarding syslog messages from UNIX/Linux devices

Resource Manager has its own syslog server (zensyslog). Managed devices should point their syslog daemons to the system.

To do this, edit the /etc/rsyslog.conf file and add an entry, where 1.2.3.4 is the zensyslog IP:

Log in to the target device as a super user.
Open the /etc/rsyslog.conf file with a text editor (such as vi).
Enter *.debug, and then press the Tab key.
Enter the host name or IP address of the server. For example:
```
*.debug @192.168.X.X
```
Save the file and exit the file editor program.
Restart the Syslog service using the command below:
```
/etc/init.d/syslog restart
```

Forwarding syslog messages from a Cisco IOS router

Here are some links to Cisco commands to turn on syslog. Typically, it is easier to use syslog than SNMP traps from network devices. The most basic IOS command to send syslog messages is:

logging 1.2.3.4

Other Cisco syslog configurations

Following are additional configurations for other Cisco devices. To set up these configurations:

Log in to the target router.
Type the command enable at the prompt.
Once you are prompted for a password, enter the correct password.
Type the command config at the prompt.
Type the command terminal at the configuration prompt.
At the prompt, set the Syslog forwarding mechanism. See example below:
```
logging <IP address of the server>
```
Exit out all the prompts to the main router prompt.

Catalyst

set logging server enable set logging server 192.168.1.100 set logging level all 5 set logging server severity 6

Local Director

syslog output 20.5 no syslog console syslog host 192.168.1.100

PIX Firewalls

logging on logging standby logging timestamp logging trap notifications logging facility 19 logging host inside 192.168.1.100

Forwarding syslog messages from a Cisco CatOS switch

To forward a syslog message from a Cisco CatOS switch:

Log in to the target switch.
Type the command enable at the prompt.
Enter the password when prompted.

Set the Syslog forwarding mechanism; for example:

set logging server <IP address of the server>

You can set the types of logging information that you want the switch to provide with the commands below as examples:
```
set logging level mgmt 7 default set logging level sys 7 default set logging level filesys 7 default
```

Forwarding syslog messages using syslog-ng

Here is an example for FreeBSD and Linux platforms.

Log in to the target device as a super user.
Open /etc/syslog-ng/syslog-ng.conf file with a text editor.

Add source information to file. See the following examples:

FreeBSD:

source src { unix-dgram("/var/run/log"); internal ();};

Linux: (will gather both system and kernel logs)

source src { internal(); unix-stream("/dev/log" keep-alive(yes) max-connections(100)); pipe("/proc/kmsg"); udp(); };

Add destination information (in this case, the server). For example:
```
log { source(src); destination(zenoss); };
```