Virtual System (in VSX) Logging

[JSingh_N]

Hi,

I have doubt in virtual system logging mechanism.

We have configured 2 dedicated log servers as primary log servers and 1 as backup log server in VS.

1.) When I run command "cpstat fw -f log_connection" I see primary log servers as connected but secondary / backup log server as disconnected.

2,) When I run command "tcpdump -nni any tcp port 257" in particular VS context, I am not able to see any traffic, also netstat -an | grep 257 does not show any connection.

3.) However, when I run "tcpdump -nni any tcp port 257" in VS0, then I am able to see the traffic for log servers and also able to see the connection established for 'netstat -an | grep 257'

In few of the VS, I see output  of "cpstat fw -f log_connection" as disconnected for all three log servers but able to see logs in SmartConsole logs.

Please share your inputs regarding this behavior of VS logging. 

Regards,

Jaspal Singh

[G_W_Albrecht]

Primary Log servers all receive the logs, but secondary is used when one or all primary log servers are unreachable.

[JSingh_N]

Ok, thanks for the revert. I got your point.

Could you please share your inputs for point 2 and 3 as well?

I think there is some mechanism in case of VSX env. that I am not aware of. May be some sort of mapping with VS0 or similar to this, I am not sure for now.

[_Val_]

Logging for all VSs is done from VS0 context, this should cover 2 & 3

[Bob_Zimmerman]

Expanding on this, almost all outgoing traffic is sent from VS0. Traffic logs. Syslog data. DNS requests. NTP. RADIUS or TACACS for authentication.

VPN negotiations are the only thing I can think of offhand which originates from the firewall, but which leaves using the routing table of a VS other than 0.

[JSingh_N]

when I check in particular VS ,  "cpstat fw -f log_connection" showing primary log servers as disconnected but in VS0 same command output is 'connected.'