Cisco IOS Routers and Switches

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Cisco IOS to send logs to a Samurai Local Collector deployed on your network. Your Cisco IOS device(s) require access to the Local Collector via syslog on port 514/UDP.

To complete this Integration you will need to:

1) From your Cisco IOS device

Configure Log
Test the logging configuration
Configure ACL log

Configure Log

Use these instructions to configure Cisco IOS.

Log into the Cisco IOS device and specify the following commands:

1. en  
2. conf t  
3. no logging on  
4. archive
5. log config
6. logging enable
7. logging size 1000
8. notify syslog contenttype plaintext
9. hidekeys
10. exit
11. exit

The preceding exit commands will take you from the config-archive-log-cfg command mode to the config command mode.

12. logging host [Local Collector IP Address] where [Local Collector IP Address] is the IP address of the Samurai Local Collector deployed on your network.
13. logging trap 6
14. login on-failure log every 1
15. login on-success log every 1
16. logging origin-id hostname
17. logging source-interface [Interface Name] where [Interface Name] is the name of the interface that has access to the Samurai Local Collector.
18. no service sequence-numbers
19. no service timestamps
20. service timestamps log datetime localtime show-timezone
21. no logging message-counter syslog
22. no logging console
23. no logging monitor
24. logging buffered 16384 informational
25. logging on
26. end
27. wr mem

Test the logging configuration

Execute the following commands to generate a %SYS-5-CONFIG_I log.

conf t
end

This will test the configuration and connectivity to the Samurai Local Collector.

Configure ACL log

To configure logging of specific ACLs, add the option log to the end of the ACL to be monitored. For example:

access-list 101 deny tcp any host 192.168.35.0/24 25 log

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.