topic Re: syslog-ng configuration in Getting Data In

syslog-ng configuration

maheshnc — Thu, 25 Sep 2025 11:22:45 GMT

I need to onboard CISCO IOS switch logs with splunk, we have a syslog-ng installed on HF, could somebody explain the exact configurations to be made in syslog-ng.conf?

Thanks in Advance

Re: syslog-ng configuration

gcusello — Thu, 25 Sep 2025 12:13:46 GMT

Hi @maheshnc ,

at first I hint to use rsyslog instead of syslog-ng because it's newer.

anyway you can find a guide for syslog-ng at https://syslog-ng.github.io/ and for rsyslog at https://www.rsyslog.com/doc/index.html

If you choose to use rsyslog, I can help you.

Ciao.

Giuseppe

Re: syslog-ng configuration

PickleRick — Thu, 25 Sep 2025 16:19:57 GMT

While I'm a big fan of rsyslog myself, you can't say that it's "newer" than rsyslog.

Depending on your metric, they are either both relatively aged already (1998 vs 2004) or both quite fresh (16th July vs 10th June).

But they have huge differences in how they work internally and how they are configured. (And I'm not gonna advocate in this thread for or against any of them).

So if you already have a significantly sized environment based on one of those solutions you're unlikely to migrate to the other one due to required time and effort (but I've known an organization which migrated a huge setup; it was painful).

Re: syslog-ng configuration

PrewinThomas — Fri, 26 Sep 2025 07:09:12 GMT

@maheshnc

You can use rsyslog or syslog-ng based on your comfort and your system setup. Personally i have seen rsyslog is giving better performance for high volume environments and syslog-ng is more user friednly and easier to maintain the configs.

To your question, basic structure looks something like this for syslog-ng

# 1. Source: listen for UDP 514 source s_cisco { udp(port(514)); }; # 2. Destination: write logs to a dedicated file per device destination d_cisco { file("/var/log/cisco/$HOST/ios.log" perm(0644) create_dirs(yes)); }; # 3. Filter: accept from cisco switch IP's filter f_cisco { host("10.10.10.1") or host("10.10.10.2"); }; # 4. Log path log { source(s_cisco); filter(f_cisco); destination(d_cisco); };

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: syslog-ng configuration

PickleRick — Fri, 26 Sep 2025 16:10:53 GMT

I would say that "user friendly" and "easier to maintain" is highly subjective 😉