11-01-2007 11:26 AM
We have all of our network devices pointing the CiscoWorks and a destination for logs.
I cannot find where the logs are being stored.
I have looked "Alerts and Activity" and "Fault History"
These do not really show anything.
Are the above alerts generated by traps?
Where would I find the results of logs being sent to Ciscoworks and how can I verify the configuration?
11-01-2007 11:40 AM
If you have your devices logging to the LMS server, then you'll want to look in RME - Reports - Syslog Standard Reports.
Check and make sure the messages make it to syslog.log or syslog_info before checking the GUI for the messages.
11-01-2007 12:43 PM
Thanks.
Where can I look at the config of the Archives like
Where is it located?
How long does it hold the jobs?
11-01-2007 12:53 PM
If you're talking about configs then check under RME - Config Mgmt - Archive Mgmt
Are you talking about Archive Mgmt jobs?
11-01-2007 01:09 PM
Like the syslog.
I did a report and pulled a syslog report on a particular device and aske for the past month.
The devices (network gear) are all pointed to the CiscoWorks server as the syslog server.
Where does Ciscoworks keep the syslog information and how long does it keep it?
11-01-2007 06:49 PM
The syslog messages are you kept in the Syslog database space within RME.
Check your purge settings to see how long its kept...I believe default is 7 days for purging
11-02-2007 09:40 AM
Is there anyway to look at the log files directly through a console window when telnet into the Cisco Works Box, and not through the Cisco Works GUI? All the responses I see here seem to refer to the Cisco Works GUI and navigating to logs through menu choices there. I've already gone through Cisco Works and still can't see logs. Does anyone know the direct filepath to where logs are stored and archived so I can see if there are even any logs being generated and stored?
~Thanks.
11-02-2007 10:00 AM
The syslogs are stored in NMSROOT\log\syslog.log on Windows and /var/log/syslog_info on Solaris (by default). Once the messages are written to these files, they are read by the SyslogCollector process. That process performs any necessary filtering. The filtering configuration is pushed down to SyslogCollector from the subscribed SyslogAnalyzer processes. If you look at the NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/filters.dat
file, that will give you a good idea of what filters are active for a given Collector.
All messages that are permitted by the filter configuration are passed up to the interested SyslogAnalyzers. The Analyzers perform any relevant automated actions, and write the messages into the RME database.
11-02-2007 10:37 AM
Thanks J,
Once the messages are purged, does CiscoWorks have the capabilty to pull reports from the purged files?
If so, it would be good to purge more often than not?
Right now the purge job runs once a month and purges items older that 365 days.
11-02-2007 10:40 AM
No, RME's reports will only operate on messages stored in the RME database. If you backup the log messages to a flat file prior to purging, those messages will not be reportable within RME.
The backup feature is there for those needing to maintain a long audit trail, but not necessarily hold the messages for active reporting. That is, you store messages for two years, but you may never need to look at them unless the federal government issues a subpeona (SOX compliances, for example). In that case, keeping them in the database would be a waste.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: