Syslog Configuration

[ruchi]

Hi everyone, I'm new to Cisco Meraki and currently working with several Meraki network devices. I've observed that log collection within the Meraki dashboard is inconsistent. Specifically, during periods of high event activity, Meraki reports that too many events occurred in a short span, resulting in incomplete log capture.

We’ve ruled out any underlying network issues, so I’m exploring the option of integrating a dedicated syslog server to ensure reliable and complete log collection.

I’d appreciate insights on the following:

• Is it better to use an on-premises or cloud-based syslog server for Meraki log collection?
• What are the pros and cons of each approach?
• What syslog solutions are others using in their environments (e.g., Syslog-ng, Graylog, Splunk, LogRhythm, ELK Stack, etc.)?
• If cloud-based, which providers are recommended (e.g., Splunk Cloud, Logz.io, Datadog, Papertrail, etc.)?

My primary goal is to resolve the issue of incomplete log collection from Meraki devices.
If I choose cloud based, what complication i can encounter?

[alemabrahao]

If security and compliance are top priorities, consider on-premises or hybrid. If scalability and ease of access are more important, go cloud-based.
For Meraki-specific environments, Boundless Logs and V-App Syslog Cloud Collector are excellent cloud-native choices.

[ruchi]

I believe adopting a cloud-based syslog solution aligns well with the shared responsibility model of security, which could be a viable approach for our environment. However, I’m currently evaluating whether compliance requirements can be fully addressed through cloud-native tools, or if certain aspects still necessitate an on-premises setup.

Additionally, if we proceed with a cloud-based syslog, I anticipate the need for a secure log forwarder to ensure integrity and confidentiality during log transmission. This raises some questions around the best architectural approach to balance compliance, security, and operational efficiency.

Please let me know if my understanding is off in any way, and I’d appreciate any insights or recommendations on best practices for implementing a compliant and secure cloud-based logging solution.

[BlakeRichardson]

How big is your organisation?, KiwiSyslog NG might work depending on the size of your Org. 

[ruchi]

we are a medical company with around 500 employees but we have different location all over USA. 

[cmr]

I've used the Rapid7 log solution, the data is stored in their cloud, but they have on premise collectors to ensure data integrity.

[mlefebvre]

I would highly recommend going cloud if you can, because when you do have a security compromise of some sort the last thing you want is for your SIEM tool to be affected as well.