Configuring Cisco Devices to Use a Syslog Server

Most Cisco devices use the syslog protocol to manage system logs and alerts. But unlike their PC and server counterparts, Cisco devices lack large internal storage space for storing these logs. To overcome this limitation, Cisco devices offer the following two options:

Internal buffer The device's operating system allocates a small part of memory buffers to log the most recent messages. The buffer size is limited to few kilobytes. This option is enabled by default. However, when the device reboots, these syslog messages are lost.
Syslog Use a UNIX-style SYSLOG protocol to send messages to an external device for storing. The storage size does not depend on the router's resources and is limited only by the available disk space on the external syslog server. This option is not enabled by default.

Tip

Before configuring a Cisco device to send syslog messages, make sure that it is configured with the right date, time, and time zone. Syslog data would be useless for troubleshooting if it shows the wrong date and time. You should configure all network devices to use NTP. Using NTP ensures a correct and synchronized system clock on all devices within the network. Setting the devices with the accurate time is helpful for event correlation.

To enable syslog functionality in a Cisco network, you must configure the built-in syslog client within the Cisco devices.

Cisco devices use a severity level of warnings through emergencies to generate error messages about software or hardware malfunctions. The debugging level displays the output of debug commands. The Notice level displays interface up or down transitions and system restart messages. The informational level reloads requests and low-process stack messages.

Configuring Cisco Routers for Syslog

To configure a Cisco IOS-based router for sending syslog messages to an external syslog server, follow the steps in Table 4-11 using privileged EXEC mode.

Table 4-11. Configuring Cisco Routers for Syslog
Step	Command	Purpose
1	Router# configure terminal	Enters global configuration mode.
2	Router(config)# service timestamps type datetime [msec] [localtime] [show-timezone]	Instructs the system to timestamp syslog messages; the options for the type keyword are debug and log.
3	Router(config)#logging host	Specifies the syslog server by IP address or host name; you can specify multiple servers.
4	Router(config)# logging trap level	Specifies the kind of messages, by severity level, to be sent to the syslog server. The default is informational and lower. The possible values for level are as follows: Emergency: 0 Alert: 1 Critical: 2 Error: 3 Warning: 4 Notice: 5 Informational: 6 Debug: 7 Use the debug level with caution, because it can generate a large amount of syslog traffic in a busy network.
5	Router(config)# logging facility facility-type	Specifies the facility level used by the syslog messages; the default is local7. Possible values are local0, local1, local2, local3, local4, local5, local6, and local7.
6	Router(config)# End	Returns to privileged EXEC mode.
7	Router# show logging	Displays logging configuration.

Note

When a level is specified in the logging trap level command, the router is configured to send messages with lower severity levels as well. For example, the logging trap warning command configures the router to send all messages with the severity warning, error, critical, and emergency. Similarly, the logging trap debug command causes the router to send all messages to the syslog server. Exercise caution while enabling the debug level. Because the debug process is assigned a high CPU priority, using it in a busy network can cause the router to crash.

Example 4-12 prepares a Cisco router to send syslog messages at facility local3. Also, the router will only send messages with a severity of warning or higher. The syslog server is on a machine with an IP address of 192.168.0.30.

Example 4-12. Router Configuration for Syslog

 Router-Dallas# Router-Dallas#config terminal Enter configuration commands, one per line. End with CNTL/Z. Router-Dallas(config)#logging 192.168.0.30 Router-Dallas(config)#service timestamps debug datetime localtime show-timezone  msec Router-Dallas(config)#service timestamps log datetime localtime show-timezone msec Router-Dallas(config)#logging facility local3 Router-Dallas(config)#logging trap warning Router-Dallas(config)#end Router-Dallas#show logging Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)     Console logging: level debugging, 79 messages logged     Monitor logging: level debugging, 0 messages logged     Buffer logging: disabled     Trap logging: level warnings, 80 message lines logged         Logging to 192.168.0.30, 57 message lines logged

Configuring a Cisco Switch for Syslog

To configure a Cisco CatOS-based switch for sending syslog messages to an external syslog server, use the privileged EXEC mode commands shown in Table 4-12.

Table 4-12. Configuring a Cisco Switch for Syslog
Step	Command	Purpose
1	Switch>(enable) set logging timestamp {enable \| disable}	Configures the system to timestamp messages.
2	Switch>(enable) set logging server ip-address	Specifies the IP address of the syslog server; a maximum of three servers can be specified.
3	Switch>(enable) set logging server severity server_severity_level	Limits messages that are logged to the syslog servers by severity level.
4	Switch>(enable) set logging server facility server_facility_parameter	Specifies the facility level that would be used in the message. The default is local7. Apart from the standard facility names listed in Table 4-1, Cisco Catalyst switches use facility names that are specific to the switch. The following facility levels generate syslog messages with fixed severity levels: 5: System, Dynamic-Trunking-Protocol, Port-Aggregation-Protocol, Management, Multilayer Switching 4: CDP, UDLD 2: Other facilities
5	Switch>(enable) set logging server enable	Enables the switch to send syslog messages to the syslog servers.
6	Switch>(enable) Show logging	Displays the logging configuration.

Example 4-13 prepares a CatOS-based switch to send syslog messages at facility local4. Also, the switch will only send messages with a severity of warning or higher. The syslog server is on a machine with an IP address of 192.168.0.30.

Example 4-13. CatOS-Based Switch Configuration for Syslog

 Console> (enable) set logging timestamp enable System logging messages timestamp will be enabled. Console> (enable) set logging server 192.168.0.30 192.168.0.30 added to System logging server table. Console> (enable) set logging server facility local4 System logging server facility set to <local4> Console> (enable) set logging server severity 4 System logging server severity set to <4> Console> (enable) set logging server enable System logging messages will be sent to the configured syslog servers. Console> (enable) show logging Logging buffered size: 500 timestamp option: enabled Logging history size: 1 Logging console: enabled Logging server: enabled {192.168.0.30} server facility: LOCAL4 server severity: warnings(4 Current Logging Session: enabled Facility            Default Severity          Current Session Severity -------------       -----------------------   ------------------------ cdp                 3                         4 drip                2                         4 dtp                 5                         4 dvlan               2                         4 earl                2                         4 fddi                2                         4 filesys             2                         4 gvrp                2                         4 ip                  2                         4 kernel              2                         4 mcast               2                         4 mgmt                5                         4 mls                 5                         4 pagp                5                         4 protfilt            2                         4 pruning             2                         4 radius              2                         4 security            2                         4 snmp                2                         4 spantree            2                         4 sys                 5                         4 tac                 2                         4 tcp                 2                         4 telnet              2                         4 tftp                2                         4 udld                4                         4 vmps                2                         4 vtp                 2                         4 0(emergencies)        1(alerts)              2(critical) 3(errors)             4(warnings)            5(notifications) 6(information)        7(debugging) Console> (enable)

Configuring a Cisco PIX Firewall for Syslog

Proactive monitoring of firewall logs is an integral part of a Netadmin's duties. The firewall syslogs are useful for forensics, network troubleshooting, security evaluation, worm and virus attack mitigation, and so on. The configuration steps for enabling syslog messaging on a PIX are conceptually similar to those for IOS- or CatOS-based devices. To configure a Cisco PIX Firewall with PIX OS 4.4 and above, perform the steps shown in Table 4-13 in privileged EXEC mode.

Table 4-13. PIX Configuration for Syslog
Step	Command	Purpose
1	Pixfirewall# config terminal	Enters global configuration mode.
2	Pixfirewall(config)#logging timestamp	Specifies that each syslog message should have a timestamp value.
3	Pixfirewall(config)#logging host [interface connected to syslog server] ip_address [protocol/port]	Specifies a syslog server that is to receive the messages sent from the Cisco PIX Firewall. You can use multiple logging host commands to specify additional servers that would all receive the syslog messages. The protocol is UDP or TCP. However, a server can only be specified to receive either UDP or TCP, not both. A Cisco PIX Firewall only sends TCP syslog messages to the Cisco PIX Firewall syslog server.
4	Pixfirewall(config)#logging facility facility	Specifies the syslog facility number. Instead of specifying the name, the PIX uses a 2-digit number, as follows: local0 - 16 local1 - 17 local2 - 18 local3 - 19 local4 - 20 local5 - 21 local6 - 22 local7 - 23 The default is 20.
5	pixfirewall(config)#logging trap level	Specifies the syslog message level as a number or string. The level that you specify means that you want that level and those values less than that level. For example, if level is 3, syslog displays 0, 1, 2, and 3 messages. Possible number and string level values are as follows: 0: Emergency; System-unusable messages 1: Alert; Take immediate action 2: Critical; critical condition 3: Error; error message 4: Warning; warning message 5: Notice; normal but significant condition 6: Informational: information message 7: Debug; debug messages and log FTP commands and WWW URLs
6	pixfirewall(config)#logging on	Starts sending syslog messages to all output locations.
7	pixfirewall(config)#no logging message <message id>	Specifies a message to be suppressed.
8	pixfirewall(config)#exit	Exits global configuration mode.

Example 4-14 prepares the Cisco PIX Firewall to send syslog messages at facility local5 and severity debug and below to the syslog server. The Netadmin does not want the PIX to log message 111005. The syslog server has an IP address of 192.168.0.30.

Example 4-14. Configuring a Cisco PIX Firewall for Syslog

 Firewall-Dallas# Firewall-Dallas# config terminal Firewall-Dallas(config)# loggin time Firewall-Dallas(config)# logging host 192.168.0.30 Firewall-Dallas(config)# logging facility 21 Firewall-Dallas(config)# logging trap 7 Firewall-Dallas(config)# logging on Firewall-Dallas(config)# no logging message 111005 rewall-Dallas(config)# exit Firewall-Dallas# show logging Syslog logging: enabled     Facility: 21     Timestamp logging: enabled     Standby logging: disabled     Console logging: disabled     Monitor logging: disabled     Buffer logging: disabled     Trap logging: level debugging, 6 messages logged         Logging to inside 192.168.0.30     History logging: disabled     Device ID: disabled

For added reliability, the Cisco PIX Firewall can be configured to send syslog messages through TCP. Please note that if the syslog server disk is full, it can close the TCP connection. This will cause a denial of service because the Cisco PIX Firewall will stop all traffic until the syslog server disk space is freed. Both Kiwi Syslogd Server and PFSS offer this feature. Kiwi Syslogd has an alert mechanism to warn the Netadmin through e-mail or pager when the disk is nearing its capacity. The setting can be established from the Syslog Daemon Setup window, as shown in Figure 4-9, for Kiwi syslog configuration.

If the PIX stops because of a disk-full condition, you must first free some disk space. Then disable syslog messaging on the PIX by using the no logging host host command, followed by reenabling syslog messaging using the logging host host command.

Caution

The change in facility level for a particular message in the previous example is for illustration purposes only. Changing the facility level from its default value is an advanced Netadmin function and is strongly discouraged.

Example 4-15 shows the configuration steps for a Cisco PIX Firewall to send syslog messages at TCP port 1468.

Example 4-15. PIX Configuration for TCP Syslog

 Firewall-Dallas# config terminal Firewall-Dallas(config)# logging host inside 192.168.0.30  tcp/1468 Firewall-Dallas(config)# exit Firewall-Dallas# show logging Syslog logging: enabled     Facility: 21     Timestamp logging: enabled     Standby logging: disabled     Console logging: disabled     Monitor logging: disabled     Buffer logging: disabled     Trap logging: level debugging, 12 messages logged         Logging to inside 192.168.0.30 tcp/1468     History logging: disabled     Device ID: disabled Firewall-Dallas#

Caution

A Cisco PIX Firewall facing the Internet is subjected to a large amount of unsolicited traffic in the form of ping scans, port scans, and probes. This can cause the log file to become large within days. It will be filled with data, making it difficult to search for useful information. You should fine-tune your firewall to suppress certain common messages using the no logging message message-id-number command. Additionally, use the IOS firewall features on the edge router to filter unwanted traffic before it hits the Cisco PIX Firewall.

Configuring a Cisco VPN Concentrator for Syslog

The Cisco VPN 3000 Series Concentrator provides an appliance-based solution for deploying VPN functionality across remote networks. VPN concentrators are often connected parallel to the firewalls, as shown earlier in Figure 4-1. The design simplifies the management of the network but creates security concerns. After a user has been authenticated through VPN concentrators, the user has complete access to the network. This makes a strong case for logging the messages from the VPN concentrator. To configure the Cisco VPN 3000 Series Concentrator for sending syslog messages, follow these steps:

Step 1.	Log in to the VPN concentrator using a web browser.
Step 2.	Navigate to the syslog server page by choosing Configuration > System > Events > Syslog Servers, as shown in Figure 4-12. Figure 4-12. VPN Concentrator Syslog Server
Step 3.	On the Syslog Servers page, click the Add button (see Figure 4-12).
Step 4.	Enter the IP address of the syslog server and select the facility level from the Facility drop-down menu, as shown in Figure 4-13. Save these settings and return to the Syslog Servers page by clicking the Add button. Figure 4-13. VPN Concentrator Add Syslog Server
Step 5.	To select the kind of messages that are to be sent to the syslog server, navigate to the General page by choosing Configuration > System > Events > General.
Step 6.	On the General page, select an option from the Severity to Syslog drop-down menu, as shown in Figure 4-14, and click the Apply button. Figure 4-14. VPN Concentrator General Configuration
Step 7.	To save the configuration changes, click the Save Needed icon.