syslog is not working

[carcab]

I configure syslog on my cisco router and switch, and I am no receiving any data into my splunk server. Yes I enable syslog on my devices and i enable port 514 on splunk server

thanks

[carcab]

I think the problem that I have is on my cisco devices configuration. If anyone can help me with this configuration, I will thank you.

I am using windows 7 for Splunk server.

I enable TCP and UDP in the Splunk configuration.

On my cisco devices I configure them with this commands: #logging 192.168.1.7 this address is splunk server.

On Splunk server: - Data Inputs UDP ( Listen on a UDP port for incoming data, e.g. syslog).
-New
-UDP port 514
-Set source type: From list
-Select source type from list: Syslog
-Save.
-What level of logging did you choose for your cisco devices? How to change the level of logging for you cisco device?
-Except Splunk is running as root/privileged ? How to run splunk as a root or privileged?

[Ayn]

Is that really the correct syntax on your Cisco device? Shouldn't it be "logging host 192.168.1.7"?

[yannK]

Maybe a kernel security, Did you checked this answer ?
http://splunk-base.splunk.com/answers/12876/splunk-running-on-my-linux-server-is-only-showing-me-eve...

[seunomosowon]

Except Splunk is running as root/privileged user (not recommended), It would not listen on ports below 1024. Syslog uses UDP 514. You could also have your iptables redirect port 514 to a higher port which splunk can listen on.

[Voltaire]

Did you enable TCP or UDP in the Splunk configuration? What level of logging did you choose for your cisco devices? what OS are you using for your splunk server?