[AusNOG] Graylog router messages

[Michael Junek]

Further to Steve's comment, you can set the various levels of information sent to Syslog.

Use the logging trap command, with the level of alerts being sent, as per below--



router(config)#logging trap ?
  <0-7>          Logging severity level
  alerts         Immediate action needed           (severity=1)
  critical       Critical conditions               (severity=2)
  debugging      Debugging messages                (severity=7)
  emergencies    System is unusable                (severity=0)
  errors         Error conditions                  (severity=3)
  informational  Informational messages            (severity=6)
  notifications  Normal but significant conditions (severity=5)
  warnings       Warning conditions                (severity=4)
  <cr>






________________________________
From: AusNOG <ausnog-bounces at lists.ausnog.net> on behalf of Mister Pink <misterpink at gmail.com>
Sent: Wednesday, 1 March 2017 13:13
To: Paul Holm
Cc: ausnog at lists.ausnog.net; Steve Hille
Subject: Re: [AusNOG] Graylog router messages

IMHO It's pretty straightforward - the source interface command may be key here - ie it's originating from an address that you are expecting, and perhaps being blocked or not classified correctly as a result.

http://www.ciscopress.com/articles/article.asp?p=426638&seqNum=3

Also bear in mind that a router is typically a lot less chatty than a F/W or a switch so it may be that under the current level of logging you are not seeing logs because nothing deemed 'interesting' enough to send is happening.


On 1 March 2017 at 08:54, Paul Holm <ausnog at pkholm.com<mailto:ausnog at pkholm.com>> wrote:
Hi Steve,

Could yo please share "not working config" from your routers?
usually it is only one line

logging host 1.1.1.1

May be with

logging source-interface xxx



On 01/03/2017 02:01, Steve Hille wrote:
Hi all, I've got Graylog running and am collecting data on all of our
Cisco switches and ASA's, also getting data from riverbeds and some
other gear. Unfortunately I can't get any messages coming in from our
Cisco routers and I can't figure out why. Has anyone got any
experience with the config on the router side to get data in? On the
other hand if anyone needs some guidance getting it setup, I'll
happily share my notes so far, getting some incredibly good data out
of it.

Cheers,

Steve


_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net<mailto:AusNOG at lists.ausnog.net>
http://lists.ausnog.net/mailman/listinfo/ausnog
_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net<mailto:AusNOG at lists.ausnog.net>
http://lists.ausnog.net/mailman/listinfo/ausnog

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20170301/94f6f78b/attachment.html>