topic logging not generating logs in HPE Aruba Networking & ProVision-based

logging not generating logs

salvation3103 — Mon, 12 Oct 2015 10:15:43 GMT

I'm trying to enable logging from our HP ProCurve switch to a network server, but nothing seems to be generated:

On the switch:

conf t
logging 192.168.21.51
logging facility local0
end

sh debug
Debug Logging
Source IP Selection: Outgoing Interface
Destination: 
Logging --
192.168.21.51
Protocol = UDP
Port = 514
Facility = local0
Severity = debug
System Module = all-pass
Priority Desc =
Enabled debug types:
event

on the server side, we are using rsyslog to collect messages, which works well with Cisco device:

# netstat -anp | grep rsyslog
udp        0      0 0.0.0.0:514             0.0.0.0:*                           20568/rsyslogd  
udp6       0      0 :::514                  :::*                                20568/rsyslogd  
unix  10     [ ]         DGRAM                    9664099  20568/rsyslogd      /dev/log

but I can't find any messages from HP Switch in /var/log/messages or in the destination log file via configuration in /etc/rsyslog.conf:

local0.*                        -/var/log/network.log

Re: logging not generating logs

TerjeAFK — Mon, 12 Oct 2015 12:35:56 GMT

We have the same setup as you: Procurve switches and rsyslog. We use a different facility, but that shouldn't matter. We use LogAnalyzer as a graphical frontend to rsyslog.

Is there a firewall between the switches and the Syslog server? Can you see the syslog traffic in the firewall logs?

Re: logging not generating logs

salvation3103 — Tue, 13 Oct 2015 01:18:35 GMT

I can be sure that there're no firewalls or any packet filters between the switch and the rsyslog server, is there any way to check if messages are being sent from the switch?

Re: logging not generating logs

TerjeAFK — Tue, 13 Oct 2015 11:55:28 GMT

Try to mirror the switch port where the syslog server is connected and use Wireshark to see if the syslog traffic is being received by the server.

Re: logging not generating logs

Michael Patmon — Tue, 13 Oct 2015 13:43:45 GMT

Also:

dut# show syslog statistics

Syslog General Statistics details

Logs Sent           : 153             Logs Recv           : 0
Logs Relay          : 0               Logs reSentError    : 0
Logs sentError      : 0               Logs reSent         : 23
Logs Buffered       : 1

Re: logging not generating logs

forgeddit — Tue, 13 Oct 2015 22:19:50 GMT

Also, install something like Kiwi syslog on your laptop, point the switch at it, and see if that receives the logs.

Re: logging not generating logs

Stephen Swain — Wed, 14 Oct 2015 19:59:48 GMT

On the server side, I find this useful for checking syslogs.

$ tcpdump -i eth0 'udp port 514'