Specifications

13-10
Cisco NAC Appliance - Clean Access Manager Configuration Guide
OL-28003-01
Chapter 13 Monitoring Event Logs
Configuring Syslog Logging
Step 1 Go to Monitoring > Event Logs > Syslog Settings.
Step 2 In the Syslog Server Address field, type the IP address of the Syslog server (default is 127.0.0.1).
Note Multiple IP Addresses are not accepted.
Step 3 In the Syslog Server Port field, type the port for the Syslog server (default is 514).
Step 4 Specify a Syslog Facility from the dropdown list. This setting enables you to optionally specify a
different Syslog facility type for Syslog messages originating from the CAM. You can use the default
“User-Level” facility type, or you can assign any of the “local use” Syslog facility types defined in the
Syslog RFC (“Local use 0” to “Local use 7”). This feature gives you the ability to differentiate Cisco
NAC Appliance Syslog messages from other “User-Level” Syslog entries you may already generate and
direct to your Syslog server from other network components.
Step 5 In the System Health Log Interval field, specify how often you want the CAM to log system status
information, in minutes (default is 60 minutes). This setting determines how frequently CAS statistics
are logged in the event log.
Step 6 In the CPU Utilization Interval field, specify how often, in seconds, you want the CAM to record CPU
utilization statistics. You can configure the CAM to record CPU status information up to nearly every
minute and the default is every 3 seconds.
Step 7 Click the Update button to save your changes.
Note After you set up your Syslog server in the CAM, you can test your configuration by logging off and
logging back into the CAM admin console. This will generate a Syslog event. If the CAM event is not
seen on your Syslog server, make sure that the Syslog server is receiving UDP 514 packets and that they
are not being blocked elsewhere on your network.
Note You can only forward to one syslog server. You can have that syslog server forward to another if required.