topic Re: Trying to capture cisco syslog errors in Getting Data In

Trying to capture cisco syslog errors

wingnut144 — Tue, 11 Dec 2012 19:38:16 GMT

I just installed Splunk, and pointed my Cisco switch and router at the Splunk server IP, and told the server to listen on port 514.

Nothing is coming in to the Splunk system.

Did I miss something????

Re: Trying to capture cisco syslog errors

dustinmalley — Wed, 09 Jan 2013 17:01:02 GMT

I had an issue with this at fist.

Ensure that you have the following configured on your Cisco devices:

logging trap (trap level)
logging host (Splunk Server) transport (tcp | udp) port (514)
logging on

In Splunk's Data Inputs:

Add a TCP or UDP type (I use TCP) and ensure that it's setup for 514 and the sourcetype is syslog

After that, I'd check to see if you have a firewall blocking port 514 (or whatever you're using) to your Splunk server.

Re: Trying to capture cisco syslog errors

mvasquez2 — Tue, 15 Mar 2016 16:53:57 GMT

i have a similar issue but I am only getting log msgs that start with "%SYS". I need to get all the data as I am running debugs. those are scrolling on the terminal screen but are not being sent to Splunk for some reason.

Re: Trying to capture cisco syslog errors

nathan01 — Mon, 08 May 2017 11:59:44 GMT

Hello,

Please does anyone have a response to the above. I am having similar issues. Not receiving any log messages on splunk from my cisco switch. There is no firewall between the devices, and i have set up splunk to listen for TCP and UDP port 514 however switches are using UDP port 514.

Thanks

Re: Trying to capture cisco syslog errors

richgalloway — Mon, 08 May 2017 13:58:03 GMT

This thread is more than 4 years old. You're more likely to get a response by posting a new question.

Re: Trying to capture cisco syslog errors

dayakadam — Fri, 15 Sep 2017 14:50:19 GMT

On the Splunk server, you must listen to UDP port 514 by going Manager -> Data Inputs -> and click Add New to UDP.