cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1261
Views
0
Helpful
8
Replies

LMS 2.5.1 RME Syslog Collector; can it forward?

Michael.Rush
Level 1
Level 1

I am using the Syslog Collector that is installed when you install RME. All of my devices are currently configured to log to the CiscoWorks server. Is there a way to have the RME Syslog Collector forward syslogs from devices on to another independent syslog collector after it has filtered the messages? (on top of passing the syslogs on to the RME syslog analyzer)

1 Accepted Solution

Accepted Solutions

I'll bet you're on Windows 2003. In that case, you need to edit the permissions on C:\windows\system32\cmd.exe to allow the casusers group to execute cmd.exe.

View solution in original post

8 Replies 8

Joe Clarke
Cisco Employee
Cisco Employee

You can subscribe multiple SyslogAnalyzers to one SyslogCollector (i.e. multiple RME servers can use one SyslogCollector each with different filters), but you cannot have the Collector forward messages to another generic syslog receptor.

However, you can use SyslogAnalyzer to then forward the syslog messages on to a different server as an automated action. See http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=Network%20Management&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1ddcf91c for more details on how to do that.

Joe,

I have reviewed this other string and have followed it, however, I am still having problems.

I have created a file D:\apps\CSCOpx\files\scripts\syslog\syslog.pl that contains:

#!/opt/CSCOpx/bin/perl

use strict;

use Sys::Syslog qw(:DEFAULT setlogsock);

my $msg = $ARGV[0];

setlogsock('inet');

$Sys::Syslog::host = '172.19.105.99';

syslog('info|local7', $msg);

closelog;

I have also created a batch file D:\apps\CSCOpx\files\scripts\syslog\syslog.bat that contains:

@ECHO OFF

D:\apps\CSCOpx\bin\perl.exe D:\apps\CSCOpx\files\scripts\syslog\syslog.pl "%~2"

I have an automated action configured and it looks like:

Name: Forward syslogs

Devices: 10.110.1.24

State: Enabled

Parameters: d:/apps/CSCOpx/files/scripts/syslog/syslog.bat

Action Type: Script

Messages: *-*-*-*:*

I have set up the log level for SyslogAnalyzer to Debug. But when a syslog is recieved from this specific device here is what shows up in the AnalyzerDebug.log:

[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],About to execute "d:/apps/CSCOpx/files/scripts/syslog/syslog.bat"

[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],Command line after substitution : "d:/apps/CSCOpx/files/scripts/syslog/syslog.bat" "Device" "Aug 02 14:02:21 xxx.xxx.xxx.xxx 46263: .Aug 2 14:00:54.381: %ISDN-6-CONNECT: Interface Serial0/2/0:1 is now connected to XXXXXXXXXX N/A"

[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],Will execute "d:/apps/CSCOpx/files/scripts/syslog/syslog.bat" "Device" "Aug 02 14:02:21 xxx.xxx.xxx.xxx 46263: .Aug 2 14:00:54.381: %ISDN-6-CONNECT: Interface Serial0/2/0:1 is now connected to XXXXXXXXXX N/A"

[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],The String to be Parsed : "d:/apps/CSCOpx/files/scripts/syslog/syslog.bat" "Device" "Aug 02 14:02:21 xxx.xxx.xxx.xxx 46263: .Aug 2 14:00:54.381: %ISDN-6-CONNECT: Interface Serial0/2/0:1 is now connected to XXXXXXXXXX N/A"

[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],d:/apps/CSCOpx/files/scripts/syslog/syslog.bat

[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],Device

[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],Aug 02 14:02:21 71.153.201.242 46263: .Aug 2 14:00:54.381: %ISDN-6-CONNECT: Interface Serial0/2/0:1 is now connected to XXXXXXXXXX N/A

[ Thu Aug 02 14:02:23 CDT 2007 ],ERROR,[Thread-1],Unable to execute script. Exception is -

java.io.IOException: CreateProcess: d:/apps/CSCOpx/files/scripts/syslog/syslog.bat "Device" "Aug 02 14:02:21 xxx.xxx.xxx.xxx 46263: .Aug 2 14:00:54.381: %ISDN-6-CONNECT: Interface Serial0/2/0:1 is now connected to XXXXXXXXXX N/A" error=5

at java.lang.Win32Process.create(Native Method)

at java.lang.Win32Process.(Win32Process.java:68)

at java.lang.Runtime.execInternal(Native Method)

at java.lang.Runtime.exec(Runtime.java:566)

at java.lang.Runtime.exec(Runtime.java:491)

at java.lang.Runtime.exec(Runtime.java:457)

at com.cisco.nm.rmeng.sa.actions.RmeSaScriptHandler.runScript(RmeSaScriptHandler.java:389)

at com.cisco.nm.rmeng.sa.actions.RmeSaScriptHandler.act(RmeSaScriptHandler.java:179)

at com.cisco.nm.rmeng.fcss.actions.FcssActionProcessor.handOff(FcssActionProcessor.java:131)

at com.cisco.nm.rmeng.fcss.actions.FcssActionProcessor.process(FcssActionProcessor.java:113)

at com.cisco.nm.rmeng.fcss.actions.FcssActionProcessor.run(FcssActionProcessor.java:155)

Can you please give some insite as to what might be wrong? I am running LMS 2.5.1 on Windows with RME 4.0.4

I'll bet you're on Windows 2003. In that case, you need to edit the permissions on C:\windows\system32\cmd.exe to allow the casusers group to execute cmd.exe.

Thanks! After adding read and execute to cmd.exe it is working great!

Hi Joe,

i have created the same *.bat and *.pl as Michael, but i become the error

syslog: expected both priority and mask at d:\progra~1\CSCOpx\files\scripts\sysl

og\outofbox.pl line 9

You need to specify an argument to the Perl script. If you run it without any arguments, you will get this error. If you have used the exact same scripts, then RME will call the Perl script correctly. If you are trying to test it by running it manually, you will need to run it as:

D:\progra~1\cscopx\bin\perl d:\progra~1\CSCOpx\files\scripts\sysl

og\outofbox.pl "Hello World"

That should send a syslog message with the contents "Hello World" to your syslog server.

Thanks. Can i test it this script only at a syslog server ?

that's been taken care of now, thanks for your help

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: