Cisco – Unable to see logs in “show logging”

cisco

I'm unable to see any new logs about from Mar 8 in Cisco Nexus C9372PX
my logging configuration is as follows:

CORENEXUS02# show logging 

Logging console:                enabled (Severity: critical)
Logging monitor:                enabled (Severity: notifications)
Logging linecard:               enabled (Severity: notifications)
Logging timestamp:              Seconds
Logging source-interface :      enabled (Interface: loopback11)
Logging server:                 enabled
{10.22.34.116}
        server severity:        notifications
        server facility:        local7
        server VRF:             lan
        server port:            5560
Logging logflash:               enabled (Severity: notifications)
Logging logfile:                enabled

CORENEXUS02# show  running-config | include logging
logging level snmpd 3
ntp logging
logging server 10.22.34.116 5 port 5560 use-vrf lan
logging source-interface loopback11

No logs are sent to syslog or shown is in show logging.

Seems like the logging process is stopped or not working at all.
What can i do to troubleshoot?

Best Answer

I think you're using NX-OS, and at least some of the replies assume IOS.

One thing that's not related to your question... you're calling this a "core" nexus. I assume that means N7k or 9500. Does a 9500 support VDCs? At least the 7k does, and it's recommended to create an "admin" VDC. That admin VDC is where wou configure NTP; it seems like NTP is configured within a production VDC.

Anyway, back to the question at hand:

Looking at your output, it seems like you're only logging the SNMPd process. There's a decent chance there's just nothing to log.

Also, are you sure you're sending your logging traffic to the correct VRF? You've used VRF "lan" - is it setup correctly?

This is my (working) configuration on my Nexus 7010. I've redacted the router name and the IPs, but you get the idea.

N7k# sh run all | inc ^logging
logging message interface type ethernet description
logging event link-status default
logging event trunk-status default
logging event link-status enable
logging event trunk-status enable
logging server [redacted] 7 use-vrf management facility local4
logging source-interface loopback0
logging monitor 5
N7k#
N7k#
N7k# sh run vrf management

!Command: show running-config vrf management
!Time: Mon Dec 16 14:42:25 2019

version 7.3(3)D1(1)

interface mgmt0
  vrf member management
vrf context management
  ip route 0.0.0.0/0 [redacted]

N7k# 
N7k# 
N7k# 
N7k# sh run int lo0

!Command: show running-config interface loopback0
!Time: Mon Dec 16 14:43:45 2019

version 7.3(3)D1(1)

interface loopback0
  ip address [redacted]/32
  ipv6 address [redacted]/128

N7k#
N7k# sh logg last 5
2019 Dec 16 14:44:01 N7k %L2FM-2-L2FM_CONTINUOUS_MAC_MOVE: Mac Address (0050.569e.214d) in Vlan 1210 is moving continuously
2019 Dec 16 14:44:43 N7k %L2FM-2-L2FM_CONTINUOUS_MAC_MOVE: Mac Address (0050.569e.789d) in Vlan 1210 is moving continuously
2019 Dec 16 14:45:41 N7k %L2FM-2-L2FM_CONTINUOUS_MAC_MOVE: Mac Address (0050.568b.7bd2) in Vlan 1204 is moving continuously
2019 Dec 16 14:46:43 N7k %L2FM-2-L2FM_CONTINUOUS_MAC_MOVE: Mac Address (0050.56b5.02f4) in Vlan 1204 is moving continuously
2019 Dec 16 14:46:55 N7k %L2FM-2-L2FM_CONTINUOUS_MAC_MOVE: Mac Address (0050.569e.1507) in Vlan 1225 is moving continuously
N7k#
Related Topic