Syslog Automated Action not run

Answered Question
Feb 28th, 2007

Hi to all!

My router forward the syslog onto syslog_info of LMS2.6 in solaris 8.

I created a syslog automated action rules with all boxes signed to "*".

I create an automatic action script who write in a file some text.

Why the message not written?

Syslog_info is full of messages like SYS, LINK, etc, and I put "*" into the messages type.

there is some syslog collector that I've to run or anything else?

Thanks

I have this problem too.
0 votes
Correct Answer by Joe Clarke about 9 years 6 months ago

I never recommend using relative paths in Automated Action scripts. Change the "./" to a fully-qualified path to which casuser has write access. Since you are doing an append operation, make sure that file exists.

If the AA script still does not run, enable Syslog Analyzer debuggign under RME > Admin > System Preferences > Loglevel Settings, then reproduce the problem, and look at the AnalyzerDebug.log for any errors relating to your AA.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 2.8 (4 ratings)
Loading.
Leonardo Roberto Fri, 03/02/2007 - 01:28

Hi davistan..

I didn't find any report in RME Syslog Standard Report.

but syslog_info it's full!!

What happened?

David Stanford Fri, 03/02/2007 - 07:17

Hi

You need to check the following:

Are the devices sending syslog messages to the server managed devices in RME?

If so, try the following:

Go to the device and enter conf t and then exit

This should generate a config change message

Check to make sure it hits the syslog_info

When it does, wait a few minutes and then go to RME and run a report for that device to see if the message is there.

You may also want to turn on Syslog debugs in under RME - Admin - System Preferences - Loglevel Settings before doing the above

Leonardo Roberto Tue, 03/13/2007 - 04:34

Hi davistan,

I found all messages into syslog_info like that:

%SYS-5-CONFIG_I: Configured from console...

%SYS-5-RELOAD: Reload requested

I found also messages into RME Report

"Syslog Analyzer Configuration Changes Report" and "24 Hour Report".

My automatic action script it that:

-rwxr-xr-x 1 casuser casusers 64 Mar 13 12:30 Reload_Router_Switch.sh

#!/usr/bin/sh

echo "SYSLOG ACTION SUCCESS!" >> ./trace.log

but no file trace.log is created.

There is no messages filter

Any to check?

Thanks

Leonardo

miheg Tue, 03/13/2007 - 06:06

I don't think casuser has a home directory where ./trace.log could be created. How about /tmp that's world writable.

#!/usr/bin/sh

echo "SYSLOG ACTION SUCCESS!" >> /tmp/trace.log

Cheers,

Michel

Correct Answer
Joe Clarke Tue, 03/13/2007 - 09:02

I never recommend using relative paths in Automated Action scripts. Change the "./" to a fully-qualified path to which casuser has write access. Since you are doing an append operation, make sure that file exists.

If the AA script still does not run, enable Syslog Analyzer debuggign under RME > Admin > System Preferences > Loglevel Settings, then reproduce the problem, and look at the AnalyzerDebug.log for any errors relating to your AA.

Actions

This Discussion