Ciscoworks syslog configuration

Unanswered Question
Oct 4th, 2007

How do I verify the Ciscoworks syslog configuration?

I can run and see the results of inventory reports and config archives, but I see nothing when running a report on syslog.

I see in the router and switches that syslog is pointing to the ciscoworks server, but when I run a report I get nothing.

How can I verify that Ciscoworks is configured to collect and hold these events properly?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Rattlesnake_bac Thu, 04/15/2010 - 05:11

Do i need to enter logging host command on devices and what IP address and port should i use to access syslog from CiscoWorks?

yjdabear Thu, 04/15/2010 - 05:45

To help answer your first question, can you post:

"show version"

"show running | include logging"

for each type of device you want CiscoWorks to do syslog analysis for?

I don't quite understand the second part of the question: "what IP address and port should i use to access syslog from CiscoWorks". Can you elaborate?

Rattlesnake_bac Thu, 04/15/2010 - 07:37
2821#sh ver
Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(24)T2, RELEASE SOFTWARE (fc2)
Technical Support:
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Mon 19-Oct-09 17:38 by prod_rel_team
System restarted at 18:26:10 GMT Sat Dec 19 2009
System image file is "flash:c2800nm-advipservicesk9-mz.124-24.T2.bin"
Cisco 2821 (revision 53.51) with 249856K/12288K bytes of memory.
Processor board ID FHK1344F1X4
2 Gigabit Ethernet interfaces
2 Virtual Private Network (VPN) Modules
DRAM configuration is 64 bits wide with parity enabled.
239K bytes of non-volatile configuration memory.
62720K bytes of ATA CompactFlash (Read/Write)
Configuration register is 0x2102
2821#sh run | i logging
logging message-counter syslog
no logging buffered
logging host transport tcp port 1468
i am currently using Kiwi syslog daemon installed on the same server ( .100.32 ) which listens at port 1468 but i want to integrate with CiscoWorks syslog analyzer. so my question is, how to make the transmission between the router and CiscoWorks, do i have to specify different port number.
yjdabear Thu, 04/15/2010 - 09:15

Great, since you have Kiwi syslog server listening on a non-standard port and through tcp no less, all you need is to configure "logging host" on the 2800. It's implicitly equivalent to "logging host transport udp port 514", I think, but you don't need to configure the extra parts. Then check NMSROOT\log\syslog.log to make sure you're seeing the 2800's logs making into that file. If not, one thing to check is whether Windows' built-in software firewall is blocking incoming traffic on UDP port 514.

yjdabear Mon, 04/19/2010 - 09:11

Do you actually see the syslogs from the 2800 in NMSROOT\log\syslog.log? Because the Windows OS also logs to syslog.log as "Invalids", so I'm not necessarily convinced the 2800 is logging to LMS yet. To verify, can you post a few lines from NMSROOT\log\syslog.log that indicate they're from the 2800?

Rattlesnake_bac Mon, 04/19/2010 - 21:25

I finally found what the problem was. Yes, it logged into syslog.log , and showed them as invalid. The problem was that i couldnt generate reports, because there were no data. Well, the problem was the source interface's IP address. I didn't configure which interface should the device use, so Ciscoworks put all the logs into " Unexpected devices" and marked them "invalid" . Anyway, now everithyng's just fine. Thanks again for the efforts! Fri, 05/28/2010 - 12:22


I'm having the same issue, somewhat.  All syslog messages are getting getting received and forwared except level 7, debugging.  It seems like level 7 messages are getting invalidated by ciscoworks.  Can you go into more detail about the part "I didn't configure which interface should the device use"?  Thank you.

Michel Hegeraat Fri, 05/28/2010 - 13:47

try "logging source ?" on your device

the interface with the IP you use to mangen the device with should send the syslog




This Discussion