Getting Data In

How to configure Syslog-ng to receive Cisco switch log files into destination file /var/logs/cisco_switch.log

splunkfly
New Member

I'm able to get the Cisco switch log files from switch IP address to my machine, but how do I use and configure Syslog-ng to to get the switch log files into /var/logs/cisco_switch.log. I don't see any files coming into /var/logs/cisco_switch.log, but I could see the log files automatically coming into /var/log/syslog.

Appreciate any help to configure it.

Listening to incoming UDP Syslog connections

source s_src {
       system();
       internal();
       udp(port(514));
};

Destination files

destination switch01{ file(“/var/log/Cisco_switch.log”); };

########################
# Filters

filter f_switch01 { host(“SWITCH_IP_ADDRESS”); };

########################
# Log paths

log { source(s_src);  filter(f_switch01); destination(switch01); };

@include "/etc/syslog-ng/conf.d/*.conf"

If anything is wrong with the script, please correct me. Should I make any configuration settings in /etc/init.d/syslog-ng ?

0 Karma

javiergn
SplunkTrust
SplunkTrust

Rather than reinventing the wheel I'm going to point you to this wonderful post:

http://blogs.splunk.com/2016/03/11/using-syslog-ng-with-splunk/

Hope that helps

0 Karma

splunkfly
New Member

thanks ...

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...