cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1149
Views
6
Helpful
8
Replies

Syslog Automated Action not run

Hi to all!

My router forward the syslog onto syslog_info of LMS2.6 in solaris 8.

I created a syslog automated action rules with all boxes signed to "*".

I create an automatic action script who write in a file some text.

Why the message not written?

Syslog_info is full of messages like SYS, LINK, etc, and I put "*" into the messages type.

there is some syslog collector that I've to run or anything else?

Thanks

1 Accepted Solution

Accepted Solutions

I never recommend using relative paths in Automated Action scripts. Change the "./" to a fully-qualified path to which casuser has write access. Since you are doing an append operation, make sure that file exists.

If the AA script still does not run, enable Syslog Analyzer debuggign under RME > Admin > System Preferences > Loglevel Settings, then reproduce the problem, and look at the AnalyzerDebug.log for any errors relating to your AA.

View solution in original post

8 Replies 8

David Stanford
Cisco Employee
Cisco Employee

Are the messages showing in the Syslog Standard Reports in RME?

I will check...

Hi davistan..

I didn't find any report in RME Syslog Standard Report.

but syslog_info it's full!!

What happened?

Hi

You need to check the following:

Are the devices sending syslog messages to the server managed devices in RME?

If so, try the following:

Go to the device and enter conf t and then exit

This should generate a config change message

Check to make sure it hits the syslog_info

When it does, wait a few minutes and then go to RME and run a report for that device to see if the message is there.

You may also want to turn on Syslog debugs in under RME - Admin - System Preferences - Loglevel Settings before doing the above

Hi davistan,

I found all messages into syslog_info like that:

%SYS-5-CONFIG_I: Configured from console...

%SYS-5-RELOAD: Reload requested

I found also messages into RME Report

"Syslog Analyzer Configuration Changes Report" and "24 Hour Report".

My automatic action script it that:

-rwxr-xr-x 1 casuser casusers 64 Mar 13 12:30 Reload_Router_Switch.sh

#!/usr/bin/sh

echo "SYSLOG ACTION SUCCESS!" >> ./trace.log

but no file trace.log is created.

There is no messages filter

Any to check?

Thanks

Leonardo

I don't think casuser has a home directory where ./trace.log could be created. How about /tmp that's world writable.

#!/usr/bin/sh

echo "SYSLOG ACTION SUCCESS!" >> /tmp/trace.log

Cheers,

Michel

I never recommend using relative paths in Automated Action scripts. Change the "./" to a fully-qualified path to which casuser has write access. Since you are doing an append operation, make sure that file exists.

If the AA script still does not run, enable Syslog Analyzer debuggign under RME > Admin > System Preferences > Loglevel Settings, then reproduce the problem, and look at the AnalyzerDebug.log for any errors relating to your AA.

I did it, and it running now!

Thanks

Leonardo

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: