On Wednesday 20 April 2011 16:56:15 Harry Putnam wrote: > Mick writes: > > Do you get the same condensed format when you capture the logs in your > > LAN syslog server? > > I did not try that, but is there some reason to expect a difference? No, it shouldn't - after all it is the same log file that you are accessing, but wasn't sure if the gui condensed what's reported to fit it in the screen. > I have channeled logs to Syslog running on gentoo with at least 2 > different routers in the past and saw no difference in the logs. > > Do you notice a difference? I do not have a Cisco router to try it just now, but could you have a look at how your access lists are defined? Extended ACLs *should* show ports, as long as ports are used in permit/deny statements and asked to be logged; e.g. access-list 102 permit tcp host 10.10.10.2 eq 0 any eq 0 log of course IOS versions may change things, but that's how I remember it worked. -- Regards, Mick