Configure Syslogs for CX-Cloud Campus Network

Introduction

This document describes the required steps to utilize Syslog telemetry to enrich the capabilities of Automated Fault Management (AFM), Faults, and Syslogs features. 

Prerequisites

• Campus Network L2 device coverage
• Cisco Digital Network Architecture Center (DNAC)
• CX Cloud Agent (On-Prem)

Self-Service Configuration and Validation

Detailed instructions can be found here: https://www.cisco.com/c/en/us/support/docs/cloud-systems-management/cx-cloud-agent/217292-cx-cloud-agent-overview.html#anc35

Create Syslog Host Configuration via DNAC

Version 1. x: Navigate to Design > Network Settings > Network as shown in the image.

Version 2.x: Navigate to Design > Network Settings > Telemetry > Syslogs as shown in the image.

The 'syslog server' for the purpose of CX Cloud Campus Network is the CX-Agent IP Address.

Note: The device's default Syslog severity level is 6 (information) when they are assigned to a site and/or provision.

Tip: Verify the logging host command is present on an application that includes the IP address of the CX-Agent as well as any required VRF once the configuration within DNA-C is completed.

Validate Receipt of Syslog Data on CX-Agent

CLI Access to the CX-Agent requires the cxcadmin credentials. This password is created at the time of the initial deployment of the CX-Agent software and is not retrievable by TAC Support engineers. The cxcadmin user has permissions to execute the provided commands which are applicable to the process to validate the status of Syslog telemetry.

View CX-Agent syslogms Microservice Logs

1. Capture the syslogms pod name:

kubectl get pods | grep syslogms

2. Provide the full syslogms pod name and view the syslogms pod logs:

kubectl logs syslogms-654877bf9-vqskt

3. Syslogms logs increment the sent/[received] counters accordingly:

[INFO ] 2022-04-08 17:36:52.524 syslogms-654877bf9-vqskt [Timer-3] SERVICE [run] - Total message Recived : 284427 sent : 283542

4. Not all syslog events are valid for CX Cloud Campus Network, therefore, log statements confirm that a syslog message was received but otherwise rejected. The syslog origin must be a managed device via DNAC and compatible with Campus Network list of supported devices. Syslogms logs indicate if a given syslog IC has been rejected due to invalid Syslog /or unknown device IP:

[WARN ] 2022-04-11 17:07:55.377 syslogms-654877bf9-vqskt [Thread-0] SERVICE [run] - Rejected Syslog message rules not matched or ip not found - RemoteNode : 9793776e-dee3-4007-8a4b-abcd12345 ,customerid : abc1234 ,Message : {"receivedTime": 1649696875377, "syslogTimeStamp": "2022 Apr 11 17:07:55", "deviceIdentifier": "null", "sequence": "0", "component": "null", "severity": "6", "mnemonic": "null", "description": "Apr 11 17:07:54 192.168.123.123 209009: Reason : "}