Greetings of the day!

I have configured syslog-ng with a very simple configuration which is as follows-

I have made direct changes on - /etc/syslog-ng/syslog-ng.conf

And here is what I have added - source s_net { udp(ip( port(514)); }; destination path { file("/var/log/dev.log"); }; filter ipaddr { host( "" ); }; log { source ( s_net ); filter( ipaddr ); destination ( path ); }; - Is the Ubuntu 16.04/syslog server - Is the Cisco Router

There is reach ability- Router1#ping

Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds: !!!!!

distro@ubuntu:/home$ ping PING ( 56(84) bytes of data. 64 bytes from icmp_seq=1 ttl=254 time=4.03 ms 64 bytes from icmp_seq=2 ttl=254 time=10.2 ms 64 bytes from icmp_seq=3 ttl=254 time=7.50 ms ^C --- ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2004ms

distro@ubuntu:/home$ sudo netstat -telnup | grep syslog udp 0 0* 0 98403 5570/syslog-ng

Router is configured fine-

logging buffered 4096 logging trap debugging logging facility syslog logging source-interface FastEthernet0/0 logging logging synchronous logging synchronous logging synchronous level all ntp logging

Router1#show log Trap logging: level debugging, 404 message lines logged Logging to (udp port 514, audit disabled, authentication disabled, encryption disabled, link up), 164 message lines logged,

But the issue I am not able to see any logs.Nor there are any files created - /var/log/dev.log

Also there is another issue were when I wanted to test the syslog connectivity

distro@ubuntu:/home$ telnet 514 Trying telnet: Unable to connect to remote host: Connection refused

As you can imagine the connectivity fails from Router telnetting into the syslog server.

There is no firewall configuration -

distro@ubuntu:/home$ sudo iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination

Chain FORWARD (policy ACCEPT) target prot opt source destination

Chain OUTPUT (policy ACCEPT) target prot opt source destination

Kindly advice.

  • Hi, Try removing the filter from the log path and see if messages start arriving. Also, you can try to start syslog-ng with the -Fevd command-line options to see if it reports a specific error. Cisco devices tend to send messages that are not syslog compliant, so you might have some parsing errors. If that's the case, let me know. – Robert Fekete May 29 '17 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.