Configure Centralized Syslog Management and Forwarding in NextGen Port Extender
Configure syslog forwarding in your NextGen Port Extender (NGPE) topology, allowing
satellite devices to send syslog data to the aggregation device. The aggregation device collects
syslog data from the satellite devices and forwards the data to an external device. You can
configure syslogging for a variety of situations, so we cover multiple scenarios.
Configure File-Based Syslog
Configure a file to capture syslog data.
user@ad# set chassis satellite <satellite-name> system syslog file <filename> <facilities> <severity>
Confirm that syslogs are generated on the satellite
device.
user@ad> file show device-list <satellite-name> /etc/syslog.conf
Configure Match-Based Syslog
-
Configure a file to capture syslog data.
user@ad# set chassis satellite <satellite-name> system syslog file <filename> <facilities> <severity>
-
Configure match parameters using a regular expression.
user@ad# set chassis satellite <satellite-name> system syslog file <filename> match <selective string>
Confirm that syslogs are generated on the satellite
device.
user@ad> file show device-list <satellite-name> /etc/syslog.conf
Configure a Structured Format-Based Syslog
-
Configure a file to capture syslog data.
user@ad# set chassis satellite <satellite-name> system syslog file <filename> <facilities> <severity>
-
Configure the file to use the structured-format statement. This
statement has an additional sub-option of brief, which if applied
will omit English language text from the end of logged messages.
brief is an optional configuration component.
user@ad# set chassis satellite <satellite-name> system syslog file <filename> structured-data
Confirm that syslogs are generated on the satellite
device.
user@ad> file show device-list <satellite-name> /etc/syslog.conf
Configure Explicit Priority-Based Syslog
-
Configure a file to capture syslog data.
user@ad# set chassis satellite <satellite-name> system syslog file <filename> <facilities> <severity>
-
Configure the file to use the explicit-priority statement, which
includes the priority and facility in log messages.
user@ad# set chassis satellite <satellite-name> system syslog file <filename> explicit-priority
Confirm that syslogs are generated on the satellite
device.
user@ad> file show device-list <satellite-name> /etc/syslog.conf
Configure User-Based Syslog
Configure a file to capture syslog data, including the username to log.
user@ad# set chassis satellite <satellite-name> system syslog user <username> file <filename> <facilities> <severity>
Confirm that syslogs are generated on the satellite
device.
user@ad> file show device-list <satellite-name> /etc/syslog.conf
Configure Syslog Forwarding to the Aggregation Device
Configure a satellite device to send syslog data to the aggregation device.
user@ad# set chassis satellite <satellite-name> system syslog host <AD IP or hostname> <facilities> <severity>
Confirm that syslogs are forwarded from the satellite
device.
user@ad> file show /etc/syslog.conf
Configure Syslog Forwarding to an External Server
-
Configure a file to capture syslog data.
user@ad# set chassis satellite <satellite-name> system syslog file <filename> <facilities> <severity>
-
Configure a satellite device to send syslog data to the aggregation device.
user@ad# set chassis satellite <satellite-name> system syslog host <AD IP or hostname> <facilities> <severity>
-
Configure the aggregation device to forward syslogs to an external server.
user@ad# set system syslog host <external-server> <facility> <severity>
All syslog messages received from satellite devices retain their original source
address or hostname within the log format when processed by the aggregation device.
However, when these logs are sent to the external server, the source IP or hostname is
updated to that of the aggregation device. Since the original hostname is preserved in
the log format and is unique per device, logs originating from individual satellite
devices can still be easily distinguished.
Jan 7 11:34:30 10.220.12.175 sd1 last message repeated 21 times
Jan 7 11:34:32 10.220.12.175 sd1 [8814]UI_SHELL_READ_LINE: User 'root', command 'cli '
Jan 7 11:34:32 10.220.12.175 sd1 mgd[21638]: UI_AUTH_EVENT: Authenticated user 'root' assigned to class 'super-user'
Jan 7 11:34:32 10.220.12.175 sd1 mgd[21638]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' [21638], ssh-connection '10.223.74.170 35978 10.220.8.227 22', client-mode 'cli
