Syslog Configuration Generator
Generate remote logging configuration for Cisco IOS, Junos, RouterOS, rsyslog and Linux hosts, with matching severity and facility.
Result
service timestamps log datetime msec localtime show-timezone
logging buffered 65536 informational
logging trap informational
logging facility local7
logging source-interface Loopback0
logging host 10.0.0.50
no logging consoleset system syslog host 10.0.0.50 any info
set system syslog host 10.0.0.50 facility-override local7
set system syslog host 10.0.0.50 port 514
set system syslog host 10.0.0.50 source-address <loopback-ip>
set system syslog time-format year millisecond/system logging action
add name=remote target=remote remote=10.0.0.50 remote-port=514 src-address=0.0.0.0 syslog-facility=local7 bsd-syslog=yes
/system logging
add topics=info,!debug action=remote
add topics=error action=remote
add topics=warning action=remote
add topics=critical action=remote# /etc/rsyslog.d/60-netvorx-remote.conf
*.info @10.0.0.50:514
# Queue so a collector outage does not block logging
$ActionQueueType LinkedList
$ActionQueueFileName netvorx_fwd
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on# Collector side - verify messages arrive
tcpdump -ni any -A udp port 514
logger -p local7.info "netvorx test message"About Syslog Configuration Generator
Central logging is only useful if every device sends consistently: same facility scheme, same severity floor, same source identity and the same clock. This generates matching configuration across the four platforms most estates actually contain.
Sizing the local buffer
Always keep a local ring buffer alongside remote logging. When the collector or the path to it fails, the buffer is the only record of what happened — and a device that has just lost its uplink is exactly the device whose logs you need. On Cisco, logging buffered 65536 costs 64 KB of RAM and holds several hundred messages; RouterOS uses a memory action with a configurable line count. Set the buffer severity no lower than the remote severity so nothing is silently discarded locally that you expected to keep.
Facility as a routing key
Facilities local0-local7 exist for local use, and assigning them by device class - local7 for routers, local6 for switches, local5 for firewalls - lets the collector route messages into separate streams without parsing message text. It is a five-minute decision that saves a lot of grep later.
Common use cases
- Onboarding new devices onto an existing collector consistently.
- Moving from UDP to reliable TCP logging for audit requirements.
- Reducing log volume by raising the severity floor on noisy devices.
Edge cases and gotchas
- Logging to console on a busy device can consume enough CPU to affect forwarding - disable it and use the buffer.
- Without NTP, correlating events across devices is guesswork.