07-24-2007 07:02 AM
I am using the Syslog Collector that is installed when you install RME. All of my devices are currently configured to log to the CiscoWorks server. Is there a way to have the RME Syslog Collector forward syslogs from devices on to another independent syslog collector after it has filtered the messages? (on top of passing the syslogs on to the RME syslog analyzer)
Solved! Go to Solution.
08-02-2007 11:13 AM
I'll bet you're on Windows 2003. In that case, you need to edit the permissions on C:\windows\system32\cmd.exe to allow the casusers group to execute cmd.exe.
07-24-2007 08:09 AM
You can subscribe multiple SyslogAnalyzers to one SyslogCollector (i.e. multiple RME servers can use one SyslogCollector each with different filters), but you cannot have the Collector forward messages to another generic syslog receptor.
However, you can use SyslogAnalyzer to then forward the syslog messages on to a different server as an automated action. See http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=Network%20Management&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1ddcf91c for more details on how to do that.
08-02-2007 11:10 AM
Joe,
I have reviewed this other string and have followed it, however, I am still having problems.
I have created a file D:\apps\CSCOpx\files\scripts\syslog\syslog.pl that contains:
#!/opt/CSCOpx/bin/perl
use strict;
use Sys::Syslog qw(:DEFAULT setlogsock);
my $msg = $ARGV[0];
setlogsock('inet');
$Sys::Syslog::host = '172.19.105.99';
syslog('info|local7', $msg);
closelog;
I have also created a batch file D:\apps\CSCOpx\files\scripts\syslog\syslog.bat that contains:
@ECHO OFF
D:\apps\CSCOpx\bin\perl.exe D:\apps\CSCOpx\files\scripts\syslog\syslog.pl "%~2"
I have an automated action configured and it looks like:
Name: Forward syslogs
Devices: 10.110.1.24
State: Enabled
Parameters: d:/apps/CSCOpx/files/scripts/syslog/syslog.bat
Action Type: Script
Messages: *-*-*-*:*
I have set up the log level for SyslogAnalyzer to Debug. But when a syslog is recieved from this specific device here is what shows up in the AnalyzerDebug.log:
[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],About to execute "d:/apps/CSCOpx/files/scripts/syslog/syslog.bat"
[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],Command line after substitution : "d:/apps/CSCOpx/files/scripts/syslog/syslog.bat" "Device" "Aug 02 14:02:21 xxx.xxx.xxx.xxx 46263: .Aug 2 14:00:54.381: %ISDN-6-CONNECT: Interface Serial0/2/0:1 is now connected to XXXXXXXXXX N/A"
[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],Will execute "d:/apps/CSCOpx/files/scripts/syslog/syslog.bat" "Device" "Aug 02 14:02:21 xxx.xxx.xxx.xxx 46263: .Aug 2 14:00:54.381: %ISDN-6-CONNECT: Interface Serial0/2/0:1 is now connected to XXXXXXXXXX N/A"
[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],The String to be Parsed : "d:/apps/CSCOpx/files/scripts/syslog/syslog.bat" "Device" "Aug 02 14:02:21 xxx.xxx.xxx.xxx 46263: .Aug 2 14:00:54.381: %ISDN-6-CONNECT: Interface Serial0/2/0:1 is now connected to XXXXXXXXXX N/A"
[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],d:/apps/CSCOpx/files/scripts/syslog/syslog.bat
[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],Device
[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],Aug 02 14:02:21 71.153.201.242 46263: .Aug 2 14:00:54.381: %ISDN-6-CONNECT: Interface Serial0/2/0:1 is now connected to XXXXXXXXXX N/A
[ Thu Aug 02 14:02:23 CDT 2007 ],ERROR,[Thread-1],Unable to execute script. Exception is -
java.io.IOException: CreateProcess: d:/apps/CSCOpx/files/scripts/syslog/syslog.bat "Device" "Aug 02 14:02:21 xxx.xxx.xxx.xxx 46263: .Aug 2 14:00:54.381: %ISDN-6-CONNECT: Interface Serial0/2/0:1 is now connected to XXXXXXXXXX N/A" error=5
at java.lang.Win32Process.create(Native Method)
at java.lang.Win32Process.
at java.lang.Runtime.execInternal(Native Method)
at java.lang.Runtime.exec(Runtime.java:566)
at java.lang.Runtime.exec(Runtime.java:491)
at java.lang.Runtime.exec(Runtime.java:457)
at com.cisco.nm.rmeng.sa.actions.RmeSaScriptHandler.runScript(RmeSaScriptHandler.java:389)
at com.cisco.nm.rmeng.sa.actions.RmeSaScriptHandler.act(RmeSaScriptHandler.java:179)
at com.cisco.nm.rmeng.fcss.actions.FcssActionProcessor.handOff(FcssActionProcessor.java:131)
at com.cisco.nm.rmeng.fcss.actions.FcssActionProcessor.process(FcssActionProcessor.java:113)
at com.cisco.nm.rmeng.fcss.actions.FcssActionProcessor.run(FcssActionProcessor.java:155)
Can you please give some insite as to what might be wrong? I am running LMS 2.5.1 on Windows with RME 4.0.4
08-02-2007 11:13 AM
I'll bet you're on Windows 2003. In that case, you need to edit the permissions on C:\windows\system32\cmd.exe to allow the casusers group to execute cmd.exe.
08-02-2007 01:13 PM
Thanks! After adding read and execute to cmd.exe it is working great!
08-09-2007 10:22 PM
Hi Joe,
i have created the same *.bat and *.pl as Michael, but i become the error
syslog: expected both priority and mask at d:\progra~1\CSCOpx\files\scripts\sysl
og\outofbox.pl line 9
08-09-2007 10:28 PM
You need to specify an argument to the Perl script. If you run it without any arguments, you will get this error. If you have used the exact same scripts, then RME will call the Perl script correctly. If you are trying to test it by running it manually, you will need to run it as:
D:\progra~1\cscopx\bin\perl d:\progra~1\CSCOpx\files\scripts\sysl
og\outofbox.pl "Hello World"
That should send a syslog message with the contents "Hello World" to your syslog server.
08-09-2007 11:46 PM
Thanks. Can i test it this script only at a syslog server ?
08-10-2007 03:57 AM
that's been taken care of now, thanks for your help
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: