Logging

The logging stack collects syslog, SNMP traps, infrastructure/network events, Expressway collectd data, and CUCM CDR/CMR files and sends them to regional Splunk Cloud instances.

Architecture

graph TB
    subgraph Sources
        A[Devices - Syslog]
        B[Devices - SNMP Traps]
        C[CUCM Publishers - CDR and CMR]
        D[Expressway - collectd]
    end

    subgraph Collectors
        E[Syslog-ng]
        F[Telegraf Trap Receiver]
        G[SFTP and CDR Processing]
        H[collectd Ingress]
    end

    subgraph Destination
        I[Regional Splunk Cloud]
    end

    J[Inventory Metadata] --> E
    J --> F
    J --> G
    A --> E
    B --> F
    C --> G
    D --> H
    E --> I
    F --> I
    G --> I
    H --> I

Inventory-generated metadata enriches syslog, traps, and SFTP data with device, region, data-center, and customer context where applicable.

Components

Component	Purpose
Splunk Cloud	Centralized storage, search, dashboards, and log-based alerts
syslog-ng	Receives, parses, enriches, and writes device syslog for forwarding
SNMP Traps	Receives traps through the Telegraf SNMP Trap plugin
SFTP/CDR path	Receives CUCM CDR/CMR files and associates them with tenant metadata

Regional Instances

Regions	Splunk Instance
US and APAC	cisco-webxbu-wxcdi.splunkcloud.com
EMEA	cisco-webxbu-wxcdieu.splunkcloud.com

Confirm UAE routing with the platform owner before selecting an instance.