Adding new listener & sourcetype to “ nf” works for both universal forwarder and Splunk server running on any platform. There are multiple ways to ways to do this. Step 2: Configure Splunk or Splunk Universal Forwarder to Accept Logs on UDP://514 Router(config-archive-log-cfg)# notify syslog Router(config-archive-log-cfg)# hidekeys this will not send passwords to syslog Router(config-archive-log-cfg)# logging size 1000 Router(config-archive-log-cfg)# logging enable The following commands will send Cisco IOS command execution history to syslog – Router(config)# logging 1.1.1.1 IPAddr of Splunk syslog – if syslog is running other than UDP 514 – this needs to be specify here Router(config)# logging trap notifications Step 1: Configure Cisco IOS to Send Logs to Splunk “syslog”įollowing is an example configuration on a Cisco router – Installation technical procedures are following – Splunk Universal Forwarder can act as local “syslog” for IOS devices picture below-Ģ. Send logs directly to the Splunk server – Send logs to Splunk via Splunk Universal Forwarder this design suits very well in a large infrastructure. Regarding the solution design, there are two options as following –ġ. (optional) to get nice dashboards it needs two Splunk Apps – (i) Cisco Networks Add-on (TA-cisco_ios) (ii)Cisco Networks (cisco_ios) Splunk Indexer (actually this is the Splunk server)ģ. Cisco IOS devices (routers, switches, wlc, asa) configured to send IOS event to Splunk via “syslog”Ģ. Technical dependencies to get this solution are following –ġ.
Let’s talk about how we can get this solution in place. To add more cream to Splunk log consolidation solution for Cisco IOS devices – there are few Splunk plugins already available on Splunk App store! These plugins display IOS events on nice colorful dashboards with graphs & charts. Splunk server itself and Splunk Universal Forwarder both can act as a syslog server to accept logs from Cisco IOS devices. Cisco IOS event details can be send to an external system via “syslog”.
0 kommentar(er)
