Syslog weirdness

[rn4it]

I'm not sure what is going on here I have 2 WAN routers on 2 different networks, both pointed to a syslog server. 1 on the same subnet as the syslog server which isn't receiving the messages. The other router is on another networks and is routed over to the syslog server which is receiving the messages.

Both routers have the following configs for syslog
logging trap debugging
logging <ip of syslog server>

Even though they are both set to debug, on the 1 that works I get messages on info and high. Once again the router on the same subnet doesn't, routing is fine, in doing a traceroute the router that is not working goes straight to the server.

any ideas? thanks for any suggestions offered

 

[wybnormal]

I would suspect you need to setup the syslog server and the routers to use different facility. Each router will use the default which is 20(4) which is trying to dump both routers to the same set of files. What you want is a separate file for each router to avoid conflicts of data/time stamps.

Here is a nice explaination about facility

http://www.kiwisyslog.com/faq/syslog/syslog_splitting_logs.htm

Also remember that the default syslog is UDP based and not TCP. It doesnt sound like it applies here as both are on the same segment but it's an FYI.

If you are running an intel box with Windows, look at Kiwi for a very good syslog server

http://www.kiwisyslog.com/products.htm#syslog

Unix,Linux has the deamon natively

MikeS
Find me at

http://www.packetattack.com

&quot;Take advantage of the enemy's unreadiness, make your way by unexpected routes, and attack unguarded spots.&quot;
Sun Tzu

 

[rn4it]

Thanks, Mike, we are using Kiwi, and we have a number of devices all pointing to the same file. We us NTP to avoid time conflicts. Do you know how to view the traps on the router? is there a way?

Thanks for the advice
John