According to Cisco's documentation on configuring syslog on a CAM, you can only forward the NAC logs to a single external log server. If you're willing to get down and dirty with the Linux operating system underneath, then this document will show you that this is simply not the case.
To get started, tweak the default logging settings within the NAC web interface, this screen-shot shows I'm sending the syslog to the local host as local6 messages, this change will send a copy of the "normal" NAC event logs to the localhost syslog server.
Next we need to enable the localhost syslog server; the CAM is build
upon a Fedora image, so the SYSLOG daemon is already running it's just
not listening on UDP 514 (thus not yet receiving the logs configured
above). Change /etc/sysconfig/syslog
, the line:
SYSLOGD_OPTIONS="-m 0"
to
SYSLOGD_OPTIONS="-m 0 -r"
Now that the local daemon is recieving the files we need to change
/etc/syslog.conf
, here we will make two changes, One: we will write a
copy of the NAC events to disk - this will allow us to see what events
the "NAC application" is sending. The second change we'll make is the
forwarding configuration, we will put in two lines (for both our syslog
hosts) so that we send forward the syslogs to two different servers -
which was our original intention :)
Add the following lines to /etc/syslog.conf
:
# Log Messages sent from Cisco NAC Application to dedicated File
Local6.* /var/log/CiscoNAC.log
# Forward all syslog messages to host1
*.* @loghost1
# Forward all syslog messages to host2
*.* @loghost2
*NOTE: loghost1 & loghost2 need to be resolvable via DNS or in
/etc/hosts
!!
Finally restart the syslog daemon /etc/init.d/syslog restart
Housekeeping
It's good practice once we've made changes to clear up after ourselves,
these are some option steps you can take.
Add /var/log/CiscoNAC.log to logrotate, so that it doesn't just grow and
grow until you run out of disk space. This is done by editing
/etc/logrotate.d/syslog
before /var/log/messages
insert
/var/log/CiscoNAC.log
You may also want to compress your syslogs, edit /etc/logrotate.conf
and uncomment the word compress
(remove the "#") .
Important Note
When performing NAC upgrades, Cisco provide operating system package
upgrades & changes, it's important to check that after an upgrade this
config changes still exist, also I take no responsibility for Cisco's
TAC not wanting to support you because of the changes made!