Why don't I receive syslog messages from a cisco router?

[molinarf]

I have not been getting syslog info from a Cisco router. I have three switches sending syslog data to udp port 514 which can be viewed on Splunk. There is a Cisco firewall between the router and the Splunk server. I have done packet tracer on the firewall and the ports are showing open on the rules. Here is the physical setup:

Cisco 2941<-->Cisco 5510<-->Cisco 4503<--> Splunk

The error that I have been getting when I do a show log on the Cisco 2941 is "Unable to setup connection with host X.X.X.103 port 514.

My Splunk Server"
Windows 2012 R2
16 cores
256 GB RAM
Splunk installed on D:/ partition

Any assistance will be greatly appreciated.
Thank you in advance.

[hardikJsheth]

Did you add syslog input on your Splunk server ?

You can check it by logging into Splunk UI and then go to Settings --> Data Inputs --> UDP.

[molinarf]

Syslog input is set for UDP 514. That is one of the first things I did when I configured the Splunk Server.

Thanks for you input.

[mikaelbje]

If you are in fact logging with UDP there is no way for the router to know if events have been received on your syslog server, so I suspect the message you're seeing is related to routing.

1. Can you ping the syslog server?
2. Show ip route x.x.x.103 longer-prefixes
3. Perhaps you need to set a logging source-interface to send logs from the right interface?
4. Perhaps you need to set logging host x.x.x.103 use-vrf VRFNAME?

Mikael

[molinarf]

Yes, I agree with you on routing being the issue.

I can ping the management IP of the syslog server, but not the data IP.
I have set a logging interface which doesn't seem to make a difference.
I will have to do the show ip route with longer prefixes.
I don't use VRF names.

I will post what I get from the show ip route command. I am also going to try working exclusively with the management IP to see if I can get it to work.

Thank you,

[molinarf]

Taking it a little further. I made sure the source interface was correct. Due to another problem for a server vlan, It was discovered that a wrong gateway IP was put in for the server vlan. Made correction and then rebuilt the firewall rules to use IP addresses instead of network objects.

Once the IP route was corrected, and the rules input using IP addresses everything started working as it should.

Thank you for your help and input. It helped me to determine where the problems may have been.