[AusNOG] AusNOG Digest, Vol 61, Issue 8
Steve Hille
steve at kararconsulting.com
Thu Mar 2 15:59:40 EST 2017
Thanks Bill,
Yes I'm certainly producing logs, and I've got the logging level set to debug just to get as much data as I can down to Graylog:
KAL-ADM-RO01#show log
Syslog logging: enabled (0 messages dropped, 3 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
No Active Message Discriminator.
No Inactive Message Discriminator.
Console logging: level debugging, 156 messages logged, xml disabled,
filtering disabled
Monitor logging: level debugging, 0 messages logged, xml disabled,
filtering disabled
Buffer logging: level debugging, 156 messages logged, xml disabled,
filtering disabled
Exception Logging: size (8192 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled
No active filter modules.
Trap logging: level debugging, 157 message lines logged
Logging to X.X.X.X (udp port 514, audit disabled,
link down),
46 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging Source-Interface: VRF Name:
Dialer1
Log Buffer (8192 bytes):
Vlan1, changed state to up
000076: Feb 27 09:50:11 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0, changed state to down
000077: Feb 27 09:50:11 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down
000078: Feb 27 09:50:12 UTC: %LINK-3-UPDOWN: Interface FastEthernet0, changed state to up
000079: Feb 27 09:50:13 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0, changed state to up
As a test I've been bouncing one of the unused ports, observing the log show up when I do "show log", then checking Graylog and seeing nothing. I have set the logging source to be dialer 1, when I run a ping toward the Graylog server I can reach it and it can reach me from that interface.
My logging config is:
service timestamps log datetime msec localtime
logging trap debugging
logging source-interface Dialer1
logging x.x.x.x
Cheers,
-----Original Message-----
From: AusNOG [mailto:ausnog-bounces at lists.ausnog.net] On Behalf Of ausnog-request at lists.ausnog.net
Sent: Thursday, 2 March 2017 9:00 AM
To: ausnog at lists.ausnog.net
Subject: AusNOG Digest, Vol 61, Issue 8
Send AusNOG mailing list submissions to
ausnog at lists.ausnog.net
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.ausnog.net/mailman/listinfo/ausnog
or, via email, send a message with subject or body 'help' to
ausnog-request at lists.ausnog.net
You can reach the person managing the list at
ausnog-owner at lists.ausnog.net
When replying, please edit your Subject line so it is more specific than "Re: Contents of AusNOG digest..."
Today's Topics:
1. Re: Graylog router messages (Bill Walker)
2. Re: NAB IT Contact (Matt Walker)
3. Foxtel IT contact (David Bell)
----------------------------------------------------------------------
Message: 1
Date: Wed, 01 Mar 2017 20:22:04 +1300
From: Bill Walker <bill at wjw.nz>
To: ausnog at lists.ausnog.net
Subject: Re: [AusNOG] Graylog router messages
Message-ID: <d3eb2455ec8a7b7591ae4de06df8d3be at wjw.nz>
Content-Type: text/plain; charset=US-ASCII; format=flowed
If you do a:
"sh logging"
What does it tell you?
eg
Trap logging: level informational, 419925 message lines logged
Logging to 192.168.1.44 (tcp port 514, audit disabled,
link up),
417454 message lines logged,
config on this particular router is Cisco default other than:
logging host 192.168.1.44 transport tcp port 514
On 2017-03-01 18:25, Steve Hille wrote:
> Thanks all for your comments so far.
>
> Yes so I'm using logging host x.x.x.x
>
> I've set it up so far to send warnings using "logging trap warnings"
>
> I just set one of the routers up with logging trap debug to see if I
> can get something but nothing yet. Most of these routers are Cisco
> 800's running 3G, I tried setting the logging source interface to be
> the cellular interface on one of my routers but still nothing coming
> in yet.
>
> The whole network runs off a particular NTP source, which the Graylog
> server also runs off and can be seen below:
>
> Any other ideas?
>
> Cheers,
>
> Steve
>
> FROM: Michael Junek [mailto:michael at juneks.com.au]
> SENT: Wednesday, 1 March 2017 10:26 AM
> TO: Mister Pink <misterpink at gmail.com>; Paul Holm <ausnog at pkholm.com>
> CC: ausnog at lists.ausnog.net; Steve Hille <steve at kararconsulting.com>
> SUBJECT: Re: [AusNOG] Graylog router messages
>
> Further to Steve's comment, you can set the various levels of
> information sent to Syslog.
>
> Use the logging trap command, with the level of alerts being sent, as
> per below--
>
> router(config)#logging trap ?
> <0-7> Logging severity level
> alerts Immediate action needed (severity=1)
> critical Critical conditions (severity=2)
> debugging Debugging messages (severity=7)
> emergencies System is unusable (severity=0)
> errors Error conditions (severity=3)
> informational Informational messages (severity=6)
> notifications Normal but significant conditions (severity=5)
> warnings Warning conditions (severity=4)
> <cr>
>
> -------------------------
>
> FROM: AusNOG <ausnog-bounces at lists.ausnog.net> on behalf of Mister
> Pink <misterpink at gmail.com>
> SENT: Wednesday, 1 March 2017 13:13
> TO: Paul Holm
> CC: ausnog at lists.ausnog.net; Steve Hille
> SUBJECT: Re: [AusNOG] Graylog router messages
>
> IMHO It's pretty straightforward - the source interface command may be
> key here - ie it's originating from an address that you are expecting,
> and perhaps being blocked or not classified correctly as a result.
>
> http://www.ciscopress.com/articles/article.asp?p=426638&seqNum=3
>
> Also bear in mind that a router is typically a lot less chatty than a
> F/W or a switch so it may be that under the current level of logging
> you are not seeing logs because nothing deemed 'interesting' enough to
> send is happening.
>
> On 1 March 2017 at 08:54, Paul Holm <ausnog at pkholm.com> wrote:
>
>> Hi Steve,
>>
>> Could yo please share "not working config" from your routers?
>> usually it is only one line
>>
>> logging host 1.1.1.1
>>
>> May be with
>>
>> logging source-interface xxx
>>
>> On 01/03/2017 02:01, Steve Hille wrote:
>>
>>> Hi all, I've got Graylog running and am collecting data on all of
>>> our Cisco switches and ASA's, also getting data from riverbeds and
>>> some other gear. Unfortunately I can't get any messages coming in
>>> from our Cisco routers and I can't figure out why. Has anyone got
>>> any experience with the config on the router side to get data in? On
>>> the other hand if anyone needs some guidance getting it setup, I'll
>>> happily share my notes so far, getting some incredibly good data out
>>> of it.
>>>
>>> Cheers,
>>>
>>> Steve
>>>
>>> _______________________________________________
>>> AusNOG mailing list
>>> AusNOG at lists.ausnog.net
>>> http://lists.ausnog.net/mailman/listinfo/ausnog
>>
>> _______________________________________________
>> AusNOG mailing list
>> AusNOG at lists.ausnog.net
>> http://lists.ausnog.net/mailman/listinfo/ausnog
> _______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog
------------------------------
Message: 2
Date: Wed, 1 Mar 2017 09:25:20 +0000
From: Matt Walker <matt.g.walker at outlook.com>
To: "ausnog at lists.ausnog.net" <ausnog at lists.ausnog.net>
Subject: Re: [AusNOG] NAB IT Contact
Message-ID:
<SYXPR01MB0608219F3A48A4E2CBACB5DDB1290 at SYXPR01MB0608.ausprd01.prod.outlook.com>
Content-Type: text/plain; charset="us-ascii"
Hey Noggers,
Thank you to those who wrote back!
Getting the problem sorted between the organisations :)
Thanks Again,
Matt Walker
> On 23 Feb 2017, at 7:12 pm, Matt Walker <matt.g.walker at outlook.com> wrote:
>
> Hey Noggers,
>
> Looking for an off list reply with anyone who may have a contact for
> the NAB IT,
>
> We are having serious problems with their SPF record not encompassing all of their email gateways.
>
> Thanks in Advance
> Matt Walker
------------------------------
Message: 3
Date: Thu, 2 Mar 2017 10:01:56 +1100
From: David Bell <davidb at mailguard.com.au>
To: AusNOG at lists.ausnog.net
Subject: [AusNOG] Foxtel IT contact
Message-ID: <c4b93cb9-5f86-fada-11c6-3c100a51e48b at mailguard.com.au>
Content-Type: text/plain; charset=utf-8
Hi All,
Is there any one from, or with contacts at, Foxtel who can help me (off
list) with an issue with their website?
Thanks,
David
--
David Bell
Linux System Administrator
MailGuard.com.aup.+ 61 3 9694 4444e.davidb at mailguard.com.au
Message protected by MailGuard: e-mail anti-virus, anti-spam and content filtering.http://www.mailguard.com.au/mg
------------------------------
Subject: Digest Footer
_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net
http://lists.ausnog.net/mailman/listinfo/ausnog
------------------------------
End of AusNOG Digest, Vol 61, Issue 8
*************************************
More information about the AusNOG
mailing list