Trying to capture cisco syslog errors

[wingnut144]

I just installed Splunk, and pointed my Cisco switch and router at the Splunk server IP, and told the server to listen on port 514.

Nothing is coming in to the Splunk system.

Did I miss something????

[dayakadam]

On the Splunk server, you must listen to UDP port 514 by going Manager -> Data Inputs -> and click Add New to UDP.

[nathan01]

Hello,

Please does anyone have a response to the above. I am having similar issues. Not receiving any log messages on splunk from my cisco switch. There is no firewall between the devices, and i have set up splunk to listen for TCP and UDP port 514 however switches are using UDP port 514.

Thanks

[richgalloway]

This thread is more than 4 years old. You're more likely to get a response by posting a new question.

[mvasquez2]

i have a similar issue but I am only getting log msgs that start with "%SYS". I need to get all the data as I am running debugs. those are scrolling on the terminal screen but are not being sent to Splunk for some reason.

[dustinmalley]

I had an issue with this at fist.

Ensure that you have the following configured on your Cisco devices:

logging trap (trap level)
logging host (Splunk Server) transport (tcp | udp) port (514)
logging on

In Splunk's Data Inputs:

Add a TCP or UDP type (I use TCP) and ensure that it's setup for 514 and the sourcetype is syslog

After that, I'd check to see if you have a firewall blocking port 514 (or whatever you're using) to your Splunk server.