Re: improving signal to noise ratio from centralized network syslogs

hey,

This is done with the 'logging facility' command on the devices:

After defining your syslog server's IP address and the level of messaging you want (I set it to debug because I want to see everything):

on the routers: logging facility local0 on the switches: logging facility local1

Alternative, and more universal, way to do it is to use multiple IPs for syslog server. Then configure correct syslog server IP on the device. syslog-ng and others can all do filtering to different destinations based on the IP where message was received. -- tarko