Collecting Syslog, NetFlow, and SNMP Traps Data (153669)

You must log on to the device to configure it to collect syslog, NetFlow, or SNMP Traps data. When you configure the device, you must tell it to export or send the data to the IP address of the collection agent that is monitoring the device.

Additionally, when you collect Syslog and SNMP Traps data from devices, you must make sure that the Syslog Listener and SNMP Traps monitors are configured for the policy or policies to which the devices are assigned.

Enabling NetFlow

You must enable NetFlow on your devices and configure it to export its data to the collection agent that is monitoring NetFlow.

Opening Ports for NetFlow, Syslog, and SNMP Traps

In order to collect, syslog, NetFlow, and SNMP Traps data, you must make sure that you open the following ports on the devices from where you are collecting this data.

• 514 (UDP) - Syslog collector
• 162 (UDP) - SNMP Trap collector
• 2055 (UDP) - NetFlow collector
• 6343 (UDP) – sFlow collector
• 9555 (UDP) - NetFlow Alternative port #2 collector
• 995 (UDP) – NetFlow Alternative port #3 collector

NOTE: You only need to open one port for NetFlow. If port 2055 is in use by another device, you can select an alternate port to open.

The following diagram shows how Foglight NMS collects syslog, NetFlow and SNMP Traps data.