Cisco Catalyst

Receives syslog from a Cisco Catalyst switch over UDP and parses the messages into structured logs that flow into a Bindplane pipeline. The collector binds a UDP listen port and waits for the switch to forward its system messages.

Supported Telemetry

Platform	Metrics	Logs	Traces
Linux		✓
Windows		✓
macOS		✓

Prerequisites

A Cisco Catalyst switch reachable on the network and configured to forward its system messages to the collector host's IP and UDP listen port. For how to enable syslog forwarding on the switch (the logging host and logging trap commands), see Cisco's official documentation: Configuring System Message Logs (Catalyst 9300, IOS XE 17.14.x). Use the configuration guide matching your switch model and IOS/IOS XE release.

Collector-side:

• The UDP listen port (default 5140) must be open in the host firewall and any cloud security group, and reachable from the switch.
• Binding to a privileged port (below 1024, for example the standard syslog port 514) requires the collector to run with elevated privileges (root on Linux/macOS, Administrator on Windows). The default 5140 avoids this.

Configuration

Logs

Parameter	Type	Required	Default	Description
Listen Address	String	No	0.0.0.0	An IP address for the agent to bind. Typically 0.0.0.0 for most configurations.
Listen Port	Integer	No	5140	A UDP port which the agent will listen for syslog messages.

Advanced

Parameter	Type	Required	Default	Description
Timezone	Timezone	No	UTC	The timezone to use when parsing timestamps.
Parse	Boolean	No	true	Parses the log fields into structured data.

Examples

Receive Catalyst syslog on a non-privileged UDP port

Listen on all interfaces on the default UDP port 5140, and parse incoming messages into structured fields. Point the switch's logging host at this collector's IP and port 5140.

- name: listen_ip
  value: 0.0.0.0
- name: listen_port
  value: 5140
- name: timezone
  value: UTC
- name: parse
  value: true

Configuration Tips

• Cisco Catalyst forwards syslog over UDP, so this source listens on UDP only. Configure the switch's logging host to send to the collector's UDP port.
• Keep the default port 5140 to avoid running the collector with elevated privileges. If you must use the standard syslog port 514, run the collector as root/Administrator.
• Leave Parse enabled to get structured fields; disable it only if you want the raw message body preserved without field extraction.

Troubleshooting

No logs arriving

Symptoms: the pipeline shows no records from the source.

Solutions:

1. Confirm the switch is configured to forward syslog to the collector's IP and the configured UDP port (logging host and logging trap on the switch).
2. Verify the listen port is open in the host firewall and any cloud security group, and that the switch can reach the collector over UDP.
3. Confirm the Listen Address matches an interface on the collector host (0.0.0.0 binds all interfaces).

Permission denied binding the port

Symptoms: the collector fails to start or bind the listen port.

Solutions:

1. Ports below 1024 (for example 514) are privileged. Either run the collector with root/Administrator privileges or use the default 5140.

Timestamps look wrong

Symptoms: parsed log timestamps are off by a fixed offset.

Solutions:

1. Set Timezone to match the timezone the switch uses when stamping its messages.

Standalone Source

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: cisco-catalyst
spec:
  type: ciscocatalyst
  parameters:
    - name: listen_ip
      value: 0.0.0.0
    - name: listen_port
      value: 5140
    - name: timezone
      value: UTC
    - name: parse
      value: true

Related Resources

• Configuring System Message Logs (Catalyst 9300, IOS XE 17.14.x) — enable syslog forwarding on the switch.
• Plugin receiver (bindplane-otel-collector) — the receiver that runs the cisco_catalyst_logs.yaml plugin behind this source.