I have not been getting syslog info from a Cisco router. I have three switches sending syslog data to udp port 514 which can be viewed on Splunk. There is a Cisco firewall between the router and the Splunk server. I have done packet tracer on the firewall and the ports are showing open on the rules. Here is the physical setup:
Cisco 2941<-->Cisco 5510<-->Cisco 4503<--> Splunk
The error that I have been getting when I do a show log on the Cisco 2941 is "Unable to setup connection with host X.X.X.103 port 514.
My Splunk Server"
Windows 2012 R2
256 GB RAM
Splunk installed on D:/ partition
Any assistance will be greatly appreciated.
Thank you in advance.
If you are in fact logging with UDP there is no way for the router to know if events have been received on your syslog server, so I suspect the message you're seeing is related to routing.
Yes, I agree with you on routing being the issue.
I can ping the management IP of the syslog server, but not the data IP.
I have set a logging interface which doesn't seem to make a difference.
I will have to do the show ip route with longer prefixes.
I don't use VRF names.
I will post what I get from the show ip route command. I am also going to try working exclusively with the management IP to see if I can get it to work.
Taking it a little further. I made sure the source interface was correct. Due to another problem for a server vlan, It was discovered that a wrong gateway IP was put in for the server vlan. Made correction and then rebuilt the firewall rules to use IP addresses instead of network objects.
Once the IP route was corrected, and the rules input using IP addresses everything started working as it should.
Thank you for your help and input. It helped me to determine where the problems may have been.