Getting Data In

Why don't I receive syslog messages from a cisco router?


I have not been getting syslog info from a Cisco router. I have three switches sending syslog data to udp port 514 which can be viewed on Splunk. There is a Cisco firewall between the router and the Splunk server. I have done packet tracer on the firewall and the ports are showing open on the rules. Here is the physical setup:

Cisco 2941<-->Cisco 5510<-->Cisco 4503<--> Splunk

The error that I have been getting when I do a show log on the Cisco 2941 is "Unable to setup connection with host X.X.X.103 port 514.

My Splunk Server"
Windows 2012 R2
16 cores
256 GB RAM
Splunk installed on D:/ partition

Any assistance will be greatly appreciated.
Thank you in advance.

0 Karma


Did you add syslog input on your Splunk server ?

You can check it by logging into Splunk UI and then go to Settings --> Data Inputs --> UDP.

0 Karma


Syslog input is set for UDP 514. That is one of the first things I did when I configured the Splunk Server.

Thanks for you input.

0 Karma


If you are in fact logging with UDP there is no way for the router to know if events have been received on your syslog server, so I suspect the message you're seeing is related to routing.

  1. Can you ping the syslog server?
  2. Show ip route x.x.x.103 longer-prefixes
  3. Perhaps you need to set a logging source-interface to send logs from the right interface?
  4. Perhaps you need to set logging host x.x.x.103 use-vrf VRFNAME?


0 Karma


Yes, I agree with you on routing being the issue.

I can ping the management IP of the syslog server, but not the data IP.
I have set a logging interface which doesn't seem to make a difference.
I will have to do the show ip route with longer prefixes.
I don't use VRF names.

I will post what I get from the show ip route command. I am also going to try working exclusively with the management IP to see if I can get it to work.

Thank you,

0 Karma


Taking it a little further. I made sure the source interface was correct. Due to another problem for a server vlan, It was discovered that a wrong gateway IP was put in for the server vlan. Made correction and then rebuilt the firewall rules to use IP addresses instead of network objects.

Once the IP route was corrected, and the rules input using IP addresses everything started working as it should.

Thank you for your help and input. It helped me to determine where the problems may have been.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...