So just to confirm, you do see OSPF adjacnency changes on the command line of the console but not on the syslog server. You also see other severity 5 events being logged on the syslog server but not OSPF events. Correct?
With that info, and at first glance, it looks like everything you’ve done is correct. Try some of the following troubleshooting steps:
Attempt to increase the severity level of logs that the syslog receives. Go up to 7 and try to bring down and bring back up the adjacency and see what happens. Level 7 will log EVERYTHING so if it is not in there, at least you know that something is blocking them.
Verify that the act of removing the adjacency is not disrupting network connectivity to the syslog server at the very moment it is attempting to send the information. Make changes to an adjacency that will not affect network connectivity to the syslog server.
Verify that the syslog server does not have some kind of sorting or filtering mechanisms that may not allow the desired syslog messages to appear.
Hey thanks for your reply. i got this sorted and meant to post the solution.
You were correct to suggest the following : 3. Verify that the syslog server does not have some kind of sorting or filtering mechanisms that may not allow the desired syslog messages to appear.
My syslog server was applying a filter to severity 5 events and above.
They way i worked that out was the very handy cisco command below to manually send different severity level alerts to whatever syslog server is setup on the cisco router
send log 1 test1
send log 2 test2
send log 3 test3
send log 4 test4
send log 5 test5
send log 6 test6
send log 7 test7
I then setup a second syslog server on my PC and configgured my router to send alerts to it. I noticed all alerts reached my pc syslog server ok but not the solarwinds syslog server