Buy or Renew
Buy or Renew
Cisco + Splunk: It’s a new day for your data. Learn more.
 
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
1062
Views
10
Helpful
6
Replies

Syslog debug messages not being logged - LMS 2.6

Go to solution
jedavis
Level 4
Level 4

‎06-15-2007 10:17 AM

I am having trouble getting debug messages into the syslog. This is what I know:

1. Syslog messages are being sent from the device. I verified this with a sniffer.

2. Information messages (conf t, exit) ARE making it into syslog.

3. Went to filters and disabled Sev 7 message filter

4. Turned on debug logging on CW. I never see an indication of the debug messages being received in AnalyzerDebug.log I DO see the informational messages being received.

What am I missing?

Thanks - Jeff

Labels:
0 Helpful
1 Accepted Solution

Accepted Solutions

Go to solution
Joe Clarke
Cisco Employee
Cisco Employee
In response to yjdabear

‎06-15-2007 11:16 AM

Your latter statement is correct. Debugging output is not in a format that SyslogCollector understands. Those messages will never be put in the RME database. The Sev 7 message filter are for debugging MESSAGES that are formatted like proper syslog messages, and contain a facility-severity-mnemonic header.

View solution in original post

0 Helpful
6 Replies 6

Go to solution
yjdabear
VIP Alumni
VIP Alumni

‎06-15-2007 10:40 AM

Sounds like you're conflating debug logging from two different sources: 1-3 are syslogging from network devices, while 4 is the internal app debug logging of LMS.

Since LMS reads from local7.info, I think that precludes Syslog Analysis from ever reading in the debug syslogs. Someone from Cisco once told me the debug syslogs have a different format that CiscoWorks can't handle, when explaining why my LMS 2.2 Syslog Analysis had no end of trouble after local7.info was changed to local7.debug.

Go to solution
Joe Clarke
Cisco Employee
Cisco Employee
In response to yjdabear

‎06-15-2007 11:16 AM

Your latter statement is correct. Debugging output is not in a format that SyslogCollector understands. Those messages will never be put in the RME database. The Sev 7 message filter are for debugging MESSAGES that are formatted like proper syslog messages, and contain a facility-severity-mnemonic header.

0 Helpful

Go to solution
jedavis
Level 4
Level 4
In response to Joe Clarke

‎06-15-2007 11:26 AM

OK, well that is an interesting "feature". Guess I'll just configure my sniffer to capture the frames and extract the messages from the capture files.

Thanks for the info!

0 Helpful

Go to solution
jedavis
Level 4
Level 4
In response to jedavis

‎06-15-2007 11:55 AM

I found a more interesting solution. Kiwi syslogd freeware. Tried it and verified that it does capture debug messages.

http://www.kiwisyslog.com/syslog-info.php

0 Helpful

Go to solution
yjdabear
VIP Alumni
VIP Alumni
In response to Joe Clarke

‎06-15-2007 11:56 AM

Anything incorrect?

0 Helpful

Go to solution
jedavis
Level 4
Level 4
In response to yjdabear

‎06-15-2007 12:02 PM

Nope. You are apparently correct - LMS 2.6 will not handle debug messages.

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents