Description

Incase of syslog messages not found in external syslog server and it is not clear whether the router/switch/firewall is not sending them or it is an issue on the syslog server side, we can capture traffic on the management interface (for example fxp0, em0...etc, or server-facing outgoing interface), filtering on UDP port 514 (or other explicitly configured port -if any-).

One way to achieve the above is using monitor traffic command:

monitor traffic interface <interface name> no-resolve matching "udp and port 514"

Furthermore, more options can be used with the monitor traffic command to narrow-down which traffic is exactly matched.

In addition, incase the issue is claimed to be happening with a specific log message, a unix shell utility can be utilized to emulate a specific log while monitoring the traffic (as described above) to monitor if this specific log is actually sent to the external server, further information about "logger" can be found online.

Symptoms

Log messages (or specific ones) not sent to external syslog server(s)

 

Solution

monitor traffic interface <interface name> no-resolve matching "udp and port 514"

unix shell logger utility

Modification History

2024-06-12 : Article Created