Quick Guide: Ubuntu box as syslog server
You need:
root/sudo access to a statically-addressed Ubuntu machine. (It will need to be on whenever your router is on in order to get anything good out of this.) This is your log host.
Enable access to your Cisco router.
Part 1: Set up your log host.
Step 1: before editing any of the files discussed below, be sure to back them up, e.g.:
cp /etc/syslog.conf /etc/syslog.conf.dontmessthisup
Step 2: edit /etc/syslog.conf to include this:
#router logging
local6.debug /var/log/cisco.log
This means “send all messages from facility local6, with a priority of debug or greater, to /var/log/cisco.log”.
(Note that the default facility for Cisco is local7; if you want/need to use the Cisco default, change the above accordingly.)
Step 3: create the log file I specified above:
sudo touch /var/log/cisco.log
(more…)