How can I get a Cisco device to send a log to enVision?
Hi johnny5 - At Anytime has their every been logs inside the IPDB for that cisco Router? meaning have you ever recieved logs from this router before? Couple of things to check and verify from my various field encounters.
- Can the router route to the enVision box? is it an external router? punch hole through firewall?
- Did someone in the network place a ACL or firewall between recently blocking syslog?
- Can you ping from the router to the enVision LC or ES?
- if you isseut he WR MEM command, verify you see it in the log buffer on the cisco router. You then should see that the message is present and sent a copy to the logging server X.X.X.X (EnVision).
- Did enVision classify it as unknown. this is not unsual and normal for certain IOS devices. Certian IOS/CatOS messages look very similar and enVision can't decipher which exact device, switch, router, firewall, layer3 switch, etc.. it could be, so says its unknown. Try the Clear Counter command as it appears unique enough to enVision classify the correct Cisco Infra device.
Check those things and get back to me.
IMHO, you should only have Routers and Switches sending events to enVision if they have ACLs and those ACLs have the log parameter - thus increasing the value of the information presented to enVision for the usage of a device in your licenses count. For the reminder of your Routers and Switches you should use Cisco Works or SyslogNG (aggregation point) and simply forward those messages to enVision as if they came from one source. From there, either use a smidgen of UDS to have the headers fixed and let ALL of them be represented as one device in enVision, or simply leave as Active / Unknown and do your rare root cause analysis using the event viewer with REGEX matching.