New user - Using CentOS to collect Cisco switch logs. No output to file. - Page 1

#1 twright1 7 years ago

I am a first time user of nxlog. I have a fresh install of CentOS. There is nothing on it but the base install, nxlog, netstat, and tcpdump.

I setup a very basic conf file and pointed several switches to the box but I am not getting any output to the log file.

I made sure that nslog is listening on tcp and udp 514 with netstat. I also checked to make sure packets were coming to the box with tcpdump.

Here is my nxlog.conf. Any suggestions?

########################################

# Global directives #

########################################

User nxlog

Group nxlog

LogFile /var/log/nxlog/nxlog.log

LogLevel INFO

define BASEDIR /var/log/nxlog

########################################

# Modules #

########################################

<Extension _syslog>

Module xm_syslog

</Extension>

<Input udp_in>

    Module      im_udp

    Host        0.0.0.0

    Port        514

    #Exec       parse_syslog();

</Input>

<Input tcp_in>

    Module      im_tcp

    Host        0.0.0.0

    Port        514

    #Exec        parse_syslog();

</Input>

<Output default_fileout>

Module om_file

File "%BASEDIR%/logmsg.txt"

</Output>

########################################

# Routes #

########################################

<Route 1>

Path udp_in, tcp_in => default_fileout

</Route>

Permalink

#2 b0ti Nxlog ✓ 7 years ago

#1 twright1

I am a first time user of nxlog. I have a fresh install of CentOS. There is nothing on it but the base install, nxlog, netstat, and tcpdump. I setup a very basic conf file and pointed several switches to the box but I am not getting any output to the log file. I made sure that nslog is listening on tcp and udp 514 with netstat. I also checked to make sure packets were coming to the box with tcpdump. Here is my nxlog.conf. Any suggestions? ######################################## # Global directives # ######################################## User nxlog Group nxlog LogFile /var/log/nxlog/nxlog.log LogLevel INFO define BASEDIR /var/log/nxlog ######################################## # Modules # ######################################## <Extension _syslog> Module xm_syslog </Extension> <Input udp_in> Module im_udp Host 0.0.0.0 Port 514 #Exec parse_syslog(); </Input> <Input tcp_in> Module im_tcp Host 0.0.0.0 Port 514 #Exec parse_syslog(); </Input> <Output default_fileout> Module om_file File "%BASEDIR%/logmsg.txt" </Output> ######################################## # Routes # ######################################## <Route 1> Path udp_in, tcp_in => default_fileout </Route>

I don't see anything wrong with the config , though nxlog.log should indicate any issues.

The problem is most likely on the network level. Try iptables -F perhaps?