<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Further to Steve's comment, you can set the various levels of information sent to Syslog.</p>
<p>Use the logging trap command, with the level of alerts being sent, as per below--</p>
<p><br>
</p>
<p><br>
</p>
<p>router(config)#logging trap ?<br>
<0-7> Logging severity level<br>
alerts Immediate action needed (severity=1)<br>
critical Critical conditions (severity=2)<br>
debugging Debugging messages (severity=7)<br>
emergencies System is unusable (severity=0)<br>
errors Error conditions (severity=3)<br>
informational Informational messages (severity=6)<br>
notifications Normal but significant conditions (severity=5)<br>
warnings Warning conditions (severity=4)<br>
<cr><br>
<br>
<br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> AusNOG <ausnog-bounces@lists.ausnog.net> on behalf of Mister Pink <misterpink@gmail.com><br>
<b>Sent:</b> Wednesday, 1 March 2017 13:13<br>
<b>To:</b> Paul Holm<br>
<b>Cc:</b> ausnog@lists.ausnog.net; Steve Hille<br>
<b>Subject:</b> Re: [AusNOG] Graylog router messages</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>IMHO It's pretty straightforward - the source interface command may be key here - ie it's originating from an address that you are expecting, and perhaps being blocked or not classified correctly as a result.</div>
<div><br>
</div>
<div><a href="http://www.ciscopress.com/articles/article.asp?p=426638&seqNum=3">http://www.ciscopress.com/articles/article.asp?p=426638&seqNum=3</a><br>
</div>
<div><br>
</div>
<div>Also bear in mind that a router is typically a lot less chatty than a F/W or a switch so it may be that under the current level of logging you are not seeing logs because nothing deemed 'interesting' enough to send is happening.</div>
<div><br>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On 1 March 2017 at 08:54, Paul Holm <span dir="ltr"><<a href="mailto:ausnog@pkholm.com" target="_blank">ausnog@pkholm.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
Hi Steve,<br>
<br>
Could yo please share "not working config" from your routers?<br>
usually it is only one line<br>
<br>
logging host 1.1.1.1<br>
<br>
May be with<br>
<br>
logging source-interface xxx
<div>
<div class="h5"><br>
<br>
<br>
On 01/03/2017 02:01, Steve Hille wrote:<br>
</div>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div>
<div class="h5">Hi all, I've got Graylog running and am collecting data on all of our<br>
Cisco switches and ASA's, also getting data from riverbeds and some<br>
other gear. Unfortunately I can't get any messages coming in from our<br>
Cisco routers and I can't figure out why. Has anyone got any<br>
experience with the config on the router side to get data in? On the<br>
other hand if anyone needs some guidance getting it setup, I'll<br>
happily share my notes so far, getting some incredibly good data out<br>
of it.<br>
<br>
Cheers,<br>
<br>
Steve<br>
<br>
<br>
</div>
</div>
______________________________<wbr>_________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer" target="_blank">http://lists.ausnog.net/mailma<wbr>n/listinfo/ausnog</a><br>
</blockquote>
______________________________<wbr>_________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer" target="_blank">http://lists.ausnog.net/mailma<wbr>n/listinfo/ausnog</a><br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</body>
</html>