syslog-ng configuration

[maheshnc]

I need to onboard CISCO IOS switch logs with splunk, we have a syslog-ng installed on HF, could somebody explain the exact configurations to be made in syslog-ng.conf?

Thanks in Advance

[PrewinThomas]

@maheshnc 

You can use rsyslog or syslog-ng based on your comfort and your system setup. Personally i have seen rsyslog is giving better performance for high volume environments and syslog-ng is more user friednly and easier to maintain the configs.

To your question, basic structure looks something like this for syslog-ng

# 1. Source: listen for UDP 514
source s_cisco {
udp(port(514));
};

# 2. Destination: write logs to a dedicated file per device
destination d_cisco {
file("/var/log/cisco/$HOST/ios.log"
perm(0644) create_dirs(yes));
};

# 3. Filter: accept from cisco switch IP's
filter f_cisco {
host("10.10.10.1") or host("10.10.10.2");
};

# 4. Log path
log {
source(s_cisco);
filter(f_cisco);
destination(d_cisco);
};

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[PickleRick]

I would say that "user friendly" and "easier to maintain" is highly subjective 😉

[gcusello]

Hi @maheshnc ,

at first I hint to use rsyslog instead of syslog-ng because it's newer.

anyway you can find a guide for syslog-ng at https://syslog-ng.github.io/ and for rsyslog at https://www.rsyslog.com/doc/index.html

If you choose to use rsyslog, I can help you.

Ciao.

Giuseppe

[PickleRick]

While I'm a big fan of rsyslog myself, you can't say that it's "newer" than rsyslog.

Depending on your metric, they are either both relatively aged already (1998 vs 2004) or both quite fresh (16th July vs 10th June).

But they have huge differences in how they work internally and how they are configured. (And I'm not gonna advocate in this thread for or against any of them).

So if you already have a significantly sized environment based on one of those solutions you're unlikely to migrate to the other one due to required time and effort (but I've known an organization which migrated a huge setup; it was painful).