[c-nsp] Syslog BCP on Cisco routers

[Justin M. Streiner]

On Wed, 9 Nov 2005, Kim Onnel wrote:

> I want to configure logging on a large group of routers, switches,.. to a
> centralized linux server
>
> the below configurations i have collected, please sned your thoughts,
> additions or comments:

no logging console
logging trap debugging

if you run OSPF:
router ospf XXXX
  log-adjacency-changes

if you run BGP:
router bgp XXXX
  bgp log-neighbor-changes

if you have trunk interfaces
logging event link-status
logging event trunk-status

You can also use "logging event link-status" on important non-trunk links.

if you have sub-interfaces
logging event subif-link-status (syntax may be different, it's been 
awhile)

there are also appropriately specific logging commands for ATM, frame 
relay, etc.

Judicious use of the "log" and "log-input" commands in access-lists can 
also provide crucial information.  Just be careful where you use it though 
:-)

> logging on
> *logging buffered 16384 debugging**
> logging facility local5
> * *logging source-interface loopback0
> * *logging x.x.x.x*
> logging snmp-authfail
> logging source-interface Loopback0
>
>
> line vty 0 4
> ! so i wont kill my access with too many log msgs
> no logging synchronous

If you're not doing "terminal monitor" when logged into a Cisco device, it 
normally shouldn't write log messages to the terminal.

> line con 0
> no logging synch

I'm a big fan of "no logging console".  If I get into a situation where 
the only access I have into a router is on the console, I like having that 
access not cluttered with log noise.

jms