Configuring Cisco IOS to forward events

This article covers the steps to configure Cisco devices to collect logs. 

Take the following steps to configure your Cisco device:

1. Log in to your Cisco IOS server, switch, or router.

2. Type the following command to log in to the router in privileged-exec:

enable

3. Type the following command to switch to configuration mode:

conf t 

4. Type the following commands:

logging host 192.168.1.100  
transport udp port 11529
logging source-interface <interface>

5. Type the following to configure the priority level:

logging trap Informational 
logging console Informational 

Warning is the priority setting for the logs.

6. Configure the syslog facility:

logging facility syslog

7. Save and exit.

8. Copy the running-config to startup-config by typing the following command:

copy running-config startup-config 

Example:

– sh ip interface brief
sh run | i logging
logging console informational
logging trap informational
logging facility syslog
logging source-interface Vlan101 (Need to check in Interface )
logging host 10.1.101.21

Once the configuration is done at the device level, we need to modify or check the configuration in the config file, which will be setup at the initial stage of forwarder installation.

Example:

- syslog:
   common:
    enabled: true
    data_type: CISCO_IOS
    data_hint: batch_n_seconds: 10
    batch_n_bytes: 1048576
  tcp_address: 0.0.0.0:11529
  udp_address: 0.0.0.0:11529