CiscoWorks and logging

Unanswered Question
Nov 1st, 2007
User Badges:

We have all of our network devices pointing the CiscoWorks and a destination for logs.


I cannot find where the logs are being stored.


I have looked "Alerts and Activity" and "Fault History"


These do not really show anything.


Are the above alerts generated by traps?


Where would I find the results of logs being sent to Ciscoworks and how can I verify the configuration?



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (3 ratings)
Loading.
David Stanford Thu, 11/01/2007 - 11:40
User Badges:
  • Cisco Employee,

If you have your devices logging to the LMS server, then you'll want to look in RME - Reports - Syslog Standard Reports.


Check and make sure the messages make it to syslog.log or syslog_info before checking the GUI for the messages.

wilson_1234_2 Thu, 11/01/2007 - 12:43
User Badges:

Thanks.


Where can I look at the config of the Archives like


Where is it located?


How long does it hold the jobs?

David Stanford Thu, 11/01/2007 - 12:53
User Badges:
  • Cisco Employee,

If you're talking about configs then check under RME - Config Mgmt - Archive Mgmt


Are you talking about Archive Mgmt jobs?

wilson_1234_2 Thu, 11/01/2007 - 13:09
User Badges:

Like the syslog.


I did a report and pulled a syslog report on a particular device and aske for the past month.


The devices (network gear) are all pointed to the CiscoWorks server as the syslog server.


Where does Ciscoworks keep the syslog information and how long does it keep it?

David Stanford Thu, 11/01/2007 - 18:49
User Badges:
  • Cisco Employee,

The syslog messages are you kept in the Syslog database space within RME.


Check your purge settings to see how long its kept...I believe default is 7 days for purging

jschweng Fri, 11/02/2007 - 09:40
User Badges:

Is there anyway to look at the log files directly through a console window when telnet into the Cisco Works Box, and not through the Cisco Works GUI? All the responses I see here seem to refer to the Cisco Works GUI and navigating to logs through menu choices there. I've already gone through Cisco Works and still can't see logs. Does anyone know the direct filepath to where logs are stored and archived so I can see if there are even any logs being generated and stored?


~Thanks.

Joe Clarke Fri, 11/02/2007 - 10:00
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

The syslogs are stored in NMSROOT\log\syslog.log on Windows and /var/log/syslog_info on Solaris (by default). Once the messages are written to these files, they are read by the SyslogCollector process. That process performs any necessary filtering. The filtering configuration is pushed down to SyslogCollector from the subscribed SyslogAnalyzer processes. If you look at the NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/filters.dat

file, that will give you a good idea of what filters are active for a given Collector.


All messages that are permitted by the filter configuration are passed up to the interested SyslogAnalyzers. The Analyzers perform any relevant automated actions, and write the messages into the RME database.

wilson_1234_2 Fri, 11/02/2007 - 10:37
User Badges:

Thanks J,


Once the messages are purged, does CiscoWorks have the capabilty to pull reports from the purged files?


If so, it would be good to purge more often than not?


Right now the purge job runs once a month and purges items older that 365 days.

Joe Clarke Fri, 11/02/2007 - 10:40
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

No, RME's reports will only operate on messages stored in the RME database. If you backup the log messages to a flat file prior to purging, those messages will not be reportable within RME.


The backup feature is there for those needing to maintain a long audit trail, but not necessarily hold the messages for active reporting. That is, you store messages for two years, but you may never need to look at them unless the federal government issues a subpeona (SOX compliances, for example). In that case, keeping them in the database would be a waste.

Actions

This Discussion