Dell Networking SONiC How to configure a switch to send logs to syslog servers

Summary: This article explains how to configure Dell Networking SONiC switch to send logs to syslog servers. This article uses a switch running Dell SONiC 4.1.

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Instructions

 

Prerequisites
We are using standard interface naming to demonstrate the Concepts. See the article Dell Networking S-Series: Basic Interface Configuration – SONIC 4.0  for more information regarding interface naming
 


Index

Introduction
Configure a system log server
Sample Configuration
Sample Output 

 

Introduction

By default, the system does not send Syslog messages to any server. To save Syslog messages in a remote server, you can configure the system to send system logs to the remote server.

You can also configure an optional source interface so that the system can use the IP address of that interface as the source IP address. If you do not configure a source interface, the system uses the interface IP address of the outbound interface as the source IP address. If the interface contains more than one IP addresses, the system uses the primary IP address.

Dell SONiC relies on UDP to transport log messages to the syslog server. By default Dell SONiC uses UDP port 514 as destination port for sending syslog messages to server.

 

Configure a system log server

To configure a remote Syslog server, use this global command. 
Add a syslog server

admin@DELLSONiC:~$ sonic-cli
DELLSONiC# configure
DELLSONiC(config)#logging server {hostname | ip-address | ipv6-address} [source-interface interfacetype] [remote-port port-number] [vrf vrf-name] [message-type type] [severity level] 
[vrf vrf-name]
Explanation
  • hostname - Enter the hostname of a Syslog server.
  • ip-address - Enter the IP address of the Syslog server.
  • ipv6-address - Enter the IPv6 address of the Syslog server.
  • source-interface interface-type - (Optional) Enter an Ethernet, loopback, management, port channel, or VLAN interface IP address to be used as the source interface when sending packets.
  • remote-port port-number - (Optional) Enter the remote port number. The range is from 1 to 65535. The default Remote Port is UDP 514
  • message-type type - (Optional) You can configure: log or event as message type. The default message type is log.
  • severity level - (Optional) Enter the severity level of the logs to be sent to a Syslog server. Logs only with the specified and higher severity levels are sent to configured Syslog servers. Logs with lower severity levels are not forwarded to remote servers. To forward all logs to a Syslog server, the Syslog severity can be set to the highest level 7 debug.
               The levels are: debug(7), info(6), notice(5), warning(4), error(3), crit(2), alert(1), emerg(0). The default remote severity level is notice.
  • vrf vrf-name - (Optional) Enter the name of the VRF used to send Syslog messages.
 		 
Remove syslog server

DELLSONiC# configure
DELLSONiC(config)# no logging server {hostname | ip-address | ipv6-address}
 

Sample Configuration


The following example configures the system to send Syslog messages to 10.59.142.126. 
admin@DELLSONiC:~$ sonic-cli
DELLSONiC# configure
DELLSONiC(config)# logging server 10.59.142.126

The following example configures the system to send Syslog messages to 10.59.142.125 with severity level error. 
admin@DELLSONiC:~$ sonic-cli
DELLSONiC# configure
DELLSONiC(config)# logging server 10.59.142.130 severity error

The following example configures the system to send Syslog messages to 10.59.143.28 with loopback 1 as the source interface, and from VRF1. 
admin@DELLSONiC:~$ sonic-cli
DELLSONiC# configure
DELLSONiC(config)# logging server 10.59.143.28 source-interface Loopback 1 vrf Vrf1

The following example configures the system to send Syslog messages to 10.59.136.33 with Eth1/1 as the source interface. 
admin@DELLSONiC:~$ sonic-cli
DELLSONiC# configure
DELLSONiC(config)#  logging server 10.59.136.33 source-interface Eth1/1
  
 

Sample Output 

Use command show logging servers to see syslog servers
  
DELLSONiC# show logging servers
--------------------------------------------------------------------------------------
HOST            PORT      SOURCE-INTERFACE    VRF            MESSAGE-TYPE   SEVERITY
--------------------------------------------------------------------------------------
10.59.136.33    514       Eth1/1              -              log            notice
10.59.142.126   514       -                   -              log            notice
10.59.142.130   514       -                   -              log            error
10.59.143.28    514       Loopback1           Vrf1           log            notice

Affected Products

PowerSwitch E3200-ON Series, Dell EMC Networking N3200-ON, PowerSwitch S5212F-ON, PowerSwitch S5224F-ON, PowerSwitch S5232F-ON, PowerSwitch S5248F-ON, PowerSwitch S5296F-ON, PowerSwitch Z9264F-ON, PowerSwitch Z9332F-ON, PowerSwitch Z9432F-ON
Article Properties
Article Number: 000218235
Article Type: How To
Last Modified: 06 Oct 2023
Version:  2
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.