[updated reply]
"Jose Orlando T. Ribeiro" wrote:
>
> Hi Pierre!
>
> I think your idea is great... I only didn�t understood :-)
>
> what should I enable at "ip address" to receive the logging data sent by the
> cisco router???
>
> and the "facility" to use (local[0-7])... what is that??? :-)
Configure your cisco router with the following:
no logging buffered <-- logs to server rather than in memory
logging trap debugging <-- sets level of events to log (debugging = all)
logging facility local6 <-- sets facility
logging 192.168.1.123 <-- logs to host 192.168.1.123
Then, in your syslog host:
/etc/syslog.conf:
# Cisco logging
local6.* /var/log/cisco <-- I use /home/logs/RouterLog
to avoid filling /var
Forgot to mention that the above log file must exit before restarting the
daemon; can be created with: touch /var/log/cisco (assuming that's the name you
used in syslog.conf...
Note: localN in cisco must match localN in syslog.conf
Make sure syslogd is installed; then in /etc/init.d/syslog's start section:
daemon syslogd -m 0 -r
^^ add this or it won't work.
Restart syslogd with: service syslog restart
HTH,
Pierre
> thanks!
>
>
> orlando
>
> Pierre Fortin wrote:
> >
> > "Jose Orlando T. Ribeiro" wrote:
> > >
> > > I have some cisco routers that I want to save the message and error logs, since
> > > the buffers in the routers is relativelly small and will be lost if I need to
> > > reboot one of them...
> >
> > Why not use "no logging buffered", "logging <IPaddress>" and let the messages go
> > to your logging host...? You can even specify which "facility" to use
> > (local[0-7]). Then let syslog and logrotate handle most of the work...
> >
> > Pierre
