You should configure all sources of syslog messages to specify the address of syslog server (machine with installed Syslog Watcher).
Devices Setup
Syslog Watcher receives messages from devices only when the devices are configured correctly. You need to specify the address of the computer where Syslog Watcher is installed. The address is specified in the device configuration. In some cases, it is possible to specify additional options (e.g., minimal severity, buffer size, etc.).
The easiest way to configure the device is with Web interface. Many current devices support this method. To take advantage of this, simply enter the address of the device in the address bar of your Web browser, then follow the instructions of graphic interface.
If web interface on the device is not included, not available or simply not supported, you can use the command-line interface (CLI). Using this method is considerably more difficult, but you can configure the device more fully.
Cisco Devices with Cisco IOS Software
Cisco Switches with Cisco Catalyst Software
Cisco Security Appliances (Cisco PIX / Cisco ASA)
Cisco Devices with Cisco IOS Software
1. Connect to the device using the command-line interface (Console/TELNET/SSH)
2. Enter privileged mode with enable command
3. Enter configuration mode with configure terminal command
4. Execute logging on command to enable logging
5. Execute logging host [ip_address] command to specify destination for syslog messages ([ip_address] - host address where Syslog Watcher)
6. Use end command to return to privileged mode
7. (Optional) Execute copy running-config startup-config command to manually save the running configuration
Cisco Switches with Cisco Catalyst Software
1. Connect to the device using the command-line interface (Console/TELNET/SSH)
2. Enter enable mode with enable command
3. Execute set logging server [ip_address] command to specify destination for syslog messages ([ip_address] - host address where Syslog Watcher)
4. (Optional) Use set logging server facility and set logging server severity commands to set the facility and severity levels for messages
5. Execute set logging server enable command to enable logging
Cisco Security Appliances (Cisco PIX / Cisco ASA)
1. Connect to the device using the command-line interface (Console/TELNET/SSH)
2. Enter privileged mode with enable command
3. Enter global configuration mode with configure terminal command
4. Execute logging enable command to enable logging
5. Execute logging host [intf_name] [ip_address] command to specify destination for syslog messages ([intf_name] - interface on which the syslog server resides, [ip_address] - host address where Syslog Watcher)
6. Use exit command to return to privileged mode
7. (Optional) Execute copy running-config startup-config command to manually save the running configuration
