TABLE OF CONTENTS

• Overview
• Steps of Configuration
• Verification
  • Using the UI
  • Using the CCE SERVER

Overview

Extreme Wireless Controller is a device you can ingest logs from. In order to ingest these logs, you will need to allow port 514 through your customer firewall.

Steps of Configuration

1. Login to the extreme wireless controller.
2. From the top menu, select Controller.
   
3. From the left panel, select Logs.
   
4. In the Syslog section, to enable the Syslog function for up to three syslog servers, select the checkboxes as shown below. Your setup may be slightly different.
   
5. For each enabled Syslog server, in the IP box, type a CCE server’s IP address. This is the server that will receive the logs.
   In the Port# box, the default port for syslog (514) is displayed. CCE also uses the same port, so keep it as the default.
6. To include all system messages, select the Include all services messages checkbox. If the box is not selected, only component messages (logs and traces) are relayed. This setting applies to all three servers. The additional service message is: DHCP messages reporting users receiving IP addresses.
   
7. To include audit messages, select the Include audit messages checkbox.
   
8. To include station session event messages, select the Include station event messages checkbox.
   
9. In the Application Logs drop-down list, click the log level (local0 - local6) to be sent to the syslog server. This setting applies to all three servers.
10. If the Include all service messages checkbox is selected, the Service Logs drop-down list becomes available. Select the log level (local 0 - local 6) to be sent to the syslog server. This setting applies to all three servers.
11. If you selected the Include audit messages checkbox, the Audit Logs drop-down list becomes available. Select the log level (local 0 - local 6) to be sent to the syslog server. This setting applies to all three servers.
12. If you selected the Include station event messages checkbox, the Station Logs drop-down list becomes available. Select the log level (local0 - local6) to be sent to the syslog server. This setting applies to all three servers.
13. Select Apply.
    

Verification

Verification can be done either from the CCE Server or from the UI.

Using the UI

1. Login to the UI. Select System.
   
2. Go to Log/Flow Collection Status.
   
3. Inside Source Device IP, the IP address will be reflected.
   

Using the CCE SERVER

The command below should be run on the CCE server to check whether we are getting logs or not:

sudo tcpdump -i any host 514 and host <IP address> -AAA