Configure linux as a log host of the pix, switch, and router

Configure linux as the log host of the pix, switch, and router-Linux Enterprise Application-Linux server application information. For more information, see the following. I. linux Configuration:
1. vi/etc/sysconfig/syslog (press I to enter the vi editing status, Press ESC to return to the command line status after the editing is complete, and then enter: wq to save the disk and exit, if you do not save the disk, enter q! )
Modify SYSLOGD_OPTIONS = "-m 0"
SYSLOGD_OPTIONS = "-r-m 0" //-r allows the write of messages from a remote host

2. vi/etc/syslog. conf
Add the following content
Record all logs of the device number local4 (the default device number of the pix, corresponding to the facility of the PIX side 20) to/var/log/pix. log.
# Save pix messages all to pix. log Pix
Local4. */var/log/pix. log
# Save Switch 3550 messages all to switch. log Switch log record path
Local1. */var/log/switch. log
# Save route 2610 messages all to route. log route
Local1. */var/log/router. log


3. To avoid excessive logs, configure log rotation (man logrotate to view detailed help information)
Vi/etc/logrotate. conf
Add the following content:
# System-specific logs may be also be configured here.
# Pix logrotate
/Var/log/pix. log {
Weekly
Rotate 4
}
# Switch logrotate
/Var/log/switch. log {
Weekly
Rotate 4
}
# Router logrotate
/Var/log/router. log {
Weekly
Rotate 4
}

4. Restart the syslog service:
[Root @ localhost etc] # service syslog restart

Ii. PIX Configuration:
Pix # Logging on
Pix # Logging host 192.168.0.1 // host IP address that records logs
Pix # Logging trap 7 // specify the log message level (0: Emergency (Emergencies) 1: Alarm (Alerts) 2: severe (Critical) 3: Error (Errors) 4: warning 5: Notifications 6: Information 7: Debugging ))
Pix # Logging facility 20 // change the device number, which is local20 by default.
Pix # Exit
Pix # sh logging // you can see whether the current log is started
Pix # wr mem // Save the Configuration
(The configurations of vswitches and vrouters are basically the same as those of the PIX, so they are not repeated)

3. Check whether the configuration is successful and correct:
1. Run sh logging in the pix enable mode to check whether logging is enabled:
Pix # sh logging
Syslog logging: enable
Facility: 20
Timestamp logging: disabled
Standby logging: discable
Console logging: discable
Monitor logging: discable
Buffer logging: discable
Trap logging: level warnings, 373000 messages logged
Logging to inside 192.168.0.1
History logging: discable
Device ID: discable
Pix #
2. on linux
Run [root @ localhost etc] # tail? Cf/var/log/pix. log
Check for logs. Exit with Ctrl + c
3. troubleshooting and experiences:
The following are my errors during debugging:
(1) Use tail? When the Cf/var/log/pix. log command is run, no log records are found:
Logging facility 20 is run in configuration mode when logs cannot be output due to configuration 4 on the pix side;
(2) During configuration, errors may also be written due to carelessness, which is also a cause of configuration failure, in addition, if you do not know in the configuration process can directly go to refer to the official site information, such as pix can refer to the http://www.cisco.com where the information is very much, is also the most authoritative.