improving signal to noise ratio from centralized network syslogs

Tarko Tikan tarko at
Sun Feb 4 08:21:13 UTC 2018


> This is done with the 'logging facility'
> command on the devices:
> After defining your syslog server's IP
> address and the level of messaging you want
> (I set it to debug because I want to see
> everything):
> on the routers: logging facility local0
> on the switches:  logging facility local1

Alternative, and more universal, way to do it is to use multiple IPs for 
syslog server. Then configure correct syslog server IP on the device.

syslog-ng and others can all do filtering to different destinations 
based on the IP where message was received.


More information about the NANOG mailing list