cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
903
Views
0
Helpful
2
Replies

duplicate syslog

ly633
Level 1
Level 1

Hi, all

Now we use LMS2.6,RME 4.0.5 to send out syslog mail. In common case, it works well. But when some syslog consecutively sent out from devices, we will also get syslog mail full of our mailbox. Especially, if some incident happens in the evening, we have to wait a long time to receive the mails in the next morning. mail body like below:

1.

Dear CW2k User,

Syslog message generated from device SIA-DT-28-CS2960-2: Feb 29 11:22:40 139.24.209.3 222: 000220: Feb 29 11:19:46.449: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 000f.1faa.ed8b on port FastEthernet0/13.

2. Syslog message generated from device SIA-DT-28-CS2960-2: Feb 29 11:22:40 139.24.209.3 223: 000221: Feb 29 11:19:51.767: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 000f.1faa.ed8b on port FastEthernet0/13.

3. Syslog message generated from device SIA-DT-28-CS2960-2: Feb 29 11:22:40 139.24.209.3 224: 000222: Feb 29 11:19:57.010: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 000f.1faa.ed8b on port FastEthernet0/13.

such information is helpful for us, so we have to send such syslog in mail, but we just want one mail for it, it's enough, any idea?

2 Replies 2

Joe Clarke
Cisco Employee
Cisco Employee

RME doesn't do any de-duplication of syslog messages. All the messages sent from the device will spawn the automated actions.

I do agree that this feature would be useful to have. You should ask your account team to open a product enhancement requesting this feature.

thanks a lot for your confirmation

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: