Alcatel Unleashed

Hi guys,

I don't have much experience with this kind of configuration for the OS switches so hopefully you can help me out.
I want to send logs about configuration changes, interface status, system events and similar to my SIEM via Syslog protocol. I used the following set of commands to make the configuration, but unfortunately cannot see any logs appearing in my destination server:

swlog appid ALL level warning
swlog output socket <SIEM-IP-address>
swlog remote command-log enable
swlog console level info

The output of show swlog is as follows:

-> show swlog
Operational Status : On,
Log Device 1 : flash,
Log Device 2 : console,
Log Device 3 : ipaddr <SIEM-IP-address>,
Syslog FacilityID : local0(16),
Remote command-log : Enabled,
Console Display Level : info (6),
All Applications Trace Level : warning (5)

Where am I going wrong?

Thank you!

Kind Regards,
Blagoja

The config for syslog is okay. Are there any new messages with level warning or higher (which do you missed at your server) in the flash-output visible? Show log swlog
Otherwise you have to "create" some (f.e. login with wrong user/password)

For remote command-log maybe the following commands are necessary.
command-log enable
swlog output socket <SIEM-IP-address> remote command-log

If there are still no messages in SIEM visible than you should use wireshark/capture at the server to check it.
best regards
Silvio