This section describes how to send logs from Aruba OS.
ArubaOS 6.0
The local use facilities (local0, local1, local2, local3, local4, local5, local6, and local7) are not reserved for specific message-generating sources, and can be used for sending syslog messages. Use the show logging command to verify that the device sends logging messages.
Each syslog message is tagged with a facility field. This field allows a syslog server receiving syslogs from multiple sources to process syslogs and save them in different files. Aruba controllers can be configured to use syslog facilities from local0 to local7.
The Aruba OS tags each syslog message with a severity. The following table lists the severity levels in descending order.
Code | Severity | Description |
|---|---|---|
0 | Emergency | System is unusable |
1 | Alert | Action must be taken immediately |
2 | Critical | Critical condition |
3 | Error | Error condition |
4 | Warning | Warning condition |
5 | Notice | Normal but significant condition |
6 | Informational | Informational message |
7 | Debug | Debug message |
Note
By default, the logging level of Aruba OS is set at Warning. This means all messages with severity from Emergency to Warning are logged and sent to the syslog server.
To send logs from Aruba OS to the Comm Broker using syslog:
Configure the remote logging server and facility:
(host) (config) #logging <server IP address> user facility <facility>
where:
<server IP address>is the IP address of the remote logging server (for example, the Trellix Comm Broker).<facility>is the value of the facility field.
The following example adds the remote logging server with the IP address 10.1.2.3 with a user log type using local4.
(host) (config) #logging 10.1.2.3 user facility local4For additional Aruba OS logging information, see http://www.arubanetworks.com/techdocs/ArubaOS_61/ArubaOS_61_CLI/logging.htm.