SX550X SYSLOG no timestamp

[dasadmin]

Hello

For SX550X switch, there is no timestamp the SYSLOG outputs.

I've managed to add this to ASA and Catalyst OK but cannot find the option to do this on SX550X:

On ASA, I used: logging timestamp

On Catalyst, I used: service timestamps log datetime show-timezone

But these don't appear on SX550X - any ideas?

SW01(config)#service
  cpu-utilization      Enables the software to measure CPU utilization.
  mirror-configuration Enables the mirror-configuration service
  password-recovery    Disable password recovery
SW01(config)#logging
  aggregation          aggregation of syslog messages.
  buffered             Configure buffered logging parameters.
  cbd                  set log configuration of cbd probe
  console              Configure console logging level.
  file                 Configure logging file parameters.
  host                 Set syslog server IP address and parameters.
  on                   Enable logging to all supported destinations.
  origin-id            Set the hostname field of the SYSLOG message packets
                       sent to the SYSLOG server
  source-interface     source interface
  source-interface-ipv6 ipv6 source interface
SW01(config)#logging file
  emergencies          System is unusable
  alerts               Immediate action needed           (severity=1)
  critical             Critical conditions               (severity=2)
  errors               Error conditions                  (severity=3)
  warnings             Warning conditions                (severity=4)
  notifications        Normal but significant conditions (severity=5)
  informational        Informational messages            (severity=6)
  debugging            Debugging messages                (severity=7)
   <CR>
 SW01(config)#

Thanks in advance.

[balaji.bandi]

These are SMB switches,if you configured the Time setting - system time, that should able to get Logs with time stamp, what you see in the Logs ?

[dasadmin]

Time is set to from NTP server:

Settings:

[dasadmin]

Example SYSLOG output:

%NT_GREEN-W-EeeLldpMultiNeighbours: Multiple LLDP neighbours on port te1/0/22 - EEE operational state is FALSE
%NT_GREEN-W-EeeLldpSingleNeighbour: Single LLDP neighbour on port te1/0/22 - EEE operational state can be TRUE
%AAA-W-REJECT: New ssh connection for user user1, source x.x.x.1 destination x.x.x.254  REJECTED
%AAA-I-CONNECT: User CLI session for user user1 over ssh , source x.x.x.1 destination  x.x.x.254 ACCEPTED
%AAA-I-CONNECT: New https connection for user user1, source x.x.x.1 destination x.x.x.254 ACCEPTED
%SYSLOG-N-LOGGINGFILE: configure file logging level to 6.
%STCK SYSL-N-UNITMSG: UNIT ID 2,Msg:%SYSLOG-N-LOGGINGFILE: configure file logging level to 6.
%AAA-I-DISCONNECT: https connection for user user1, source x.x.x.1 destination x.x.x.254 TERMINATED
%COPY-I-FILECPY: Files Copy - source URL running-config destination URL flash://system/configuration/startup-config
%COPY-N-TRAP: The copy operation was completed successfully
%AAA-I-CONNECT: New https connection for user user1, source x.x.x.1 destination x.x.x.254 ACCEPTED
%AAA-I-DISCONNECT: https connection for user user1, source x.x.x.1 destination x.x.x.254 TERMINATED
%AAA-I-DISCONNECT: User CLI session for user user1 over ssh , source x.x.x.1 destination  x.x.x.254  TERMINATED. The Telnet/SSH session may still be connected.

[balaji.bandi]

is this on syslog server - what syslog server ?

[dasadmin]

This is from the log file written on syslog server - we are using Fastvue Syslog Server.

That said, when you use the switch web interface and there are sysinfo events, the toast pop-up is the same that gets written to the remote syslog server - there is no timestamp.

Thanks

[marce1000]

 - Confirm this problem on another syslog server (if possible) , meaning other brand/platform . this could be a bug. Use latest software version for Fastvue , for instance : https://releasenotes.fastvue.co/fastvue-syslog/fastvue-syslog-2-0-0-3-2018-09-11/

    >...

•               IMPROVED: Timestamps are shown in UTC.

         That is not exactly your problem (indeed)  , but could be good practice to upgrade Fastvue , if applicable.

 M.

[dasadmin]

Hello

We have the latest version FastvueSyslogServer2.0_stable.exe installed.

Thanks

[marce1000]

                             - I am still suspicious , try using another syslog server

 M.

[balaji.bandi]

Do you have other device get Time stamp which sent to this syslog server - if that works, then we need to look switch side,

if all the logs same then we need to check syslog config to tweak to get time stamp.

[dasadmin]

Hello

We are already logging Cisco ASA / Catalyst and VMware to Fastvue, and all are working as expected, with timestamps.

This SX550X is the only device we are having issues with the timestamp.

Thanks

[balaji.bandi]

For testing, is this issue with Switch or syslog server,

download syslog server on desktop, see if you can direct the logs to new syslog server, what is the outcome ?

https://www.letscontrolit.com/forum/viewtopic.php?t=4032

[Richard Burts]

I have looked into the Admin guide for this switch and into explanation of CLI commands and do not see in either of them any indication of how to assign timestamp on syslog messages. I believe that this may be a limitation of this switch model.