syslog problems
Andrew Haskell <[email protected]> Fri, 15 Aug 2003 13:40:38 +1000
| Newsgroups | gmane.linux.redhat.release.seawolf |
|---|---|
| Message-ID | <[email protected]> |
This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C362DE.FE15A900 Content-Type: text/plain; charset="iso-8859-1" I'm having an odd problem with the syslog. I'm trying to log messages from a cisco 2600 series router. I'm already logging messages from a PIX and that works fine. Using a packet sniffer I can see the upd packets going from the router to the linux box, but once they hit the linux box they just vanish. In a week I've had 1 entry into the 2600.log file. To check that the 2600.log actually logs data i've used *.* /var/log/2600.log and it logs entries as expected, well everything but the 2600 messages. syslog.conf entries of the two cisco devices local4.* /var/log/PIX.log local5.* /var/log/2600.log I've set the 2600 to use faciltiy local5 and using a syslog on another machine I can recieve the log messages that I'm expecting. But I get nothing on the linux machine. I know the udp packet are getting their, and that syslog is setup to listen on port 514/udp and it is listening (the pix.log entry works). Has anyone ever experienced anything similar? or does anyone have an idea on whats going wrong? Regards Andrew ------_=_NextPart_001_01C362DE.FE15A900 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Diso-8859-1"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = 5.5.2653.12"> <TITLE>syslog problems</TITLE> </HEAD> <BODY> <P><FONT SIZE=3D2 FACE=3D"Arial">I'm having an odd problem with the = syslog.</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Arial">I'm trying to log messages from a = cisco 2600 series router.</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">I'm already logging messages from a = PIX and that works fine.</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Arial">Using a packet sniffer I can see the = upd packets going from the router to the linux box, but once they hit = the linux box they just vanish. In a week I've had 1 entry into the = 2600.log file.</FONT></P> <P><FONT SIZE=3D2 FACE=3D"Arial">To check that the 2600.log actually = logs data i've used *.* /var/log/2600.log and it logs entries as = expected, well everything but the 2600 messages.</FONT></P> <P><FONT SIZE=3D2 FACE=3D"Arial">syslog.conf entries of the two cisco = devices</FONT> </P> <P><FONT SIZE=3D2 = FACE=3D"Arial">local4.* = = /var/log/PIX.log</FONT> <BR><FONT SIZE=3D2 = FACE=3D"Arial">local5.* = = /var/log/2600.log</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Arial">I've set the 2600 to use faciltiy = local5 and using a syslog on another machine I can recieve the log = messages that I'm expecting.</FONT></P> <P><FONT SIZE=3D2 FACE=3D"Arial">But I get nothing on the linux = machine. I know the udp packet are getting their, and that syslog is = setup to listen on port 514/udp and it is listening (the pix.log entry = works).</FONT></P> <P><FONT SIZE=3D2 FACE=3D"Arial">Has anyone ever experienced anything = similar? or does anyone have an idea on whats going wrong?</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Arial">Regards</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">Andrew</FONT> </P> </BODY> </HTML> ------_=_NextPart_001_01C362DE.FE15A900--