cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
912
Views
0
Helpful
6
Replies

Filter Syslog Question

m-ketchum
Level 1
Level 1

I'm hoping someone can point me in the right direction.

I have a router that is running Call Manager Express that is sending a lot of AAA info to a Radius server to support call logging and presence info (UCC). However, all of those AAA messages are also showing up in the log buffer AND on the syslog server.

Problem: I want to see other log messages in the syslog and NOT all the AAA/RADIUS stuff but the AAA and the messages I want to see are of the same severity level. So far I'm at an all or nothing scenario. Is there a way to not send all the AAA/RADIUS junk to the syslog server?

Thanks much.

6 Replies 6

Joe Clarke
Cisco Employee
Cisco Employee

What version of IOS is running on this router?

12.4.11XJ4

I believe this version supports the Embedded Syslog Manager which will allow you to filter the messages that you do not want. Can you post a whole message that you would like to filter out?

3314819: Mar 12 11:12:40 PDT: %ISDN-6-DISCONNECT: Interface Serial0/0/0:22 disconnected from 5555551234 , call lasted 65 seconds

3314820: Mar 12 11:12:41 PDT: %VOIPAAA-5-VOIP_CALL_HISTORY: CallLegType 1, ConnectionId 94AD2944EF9611DCB414001AA29E1B00, SetupTime 11:11:33.281 PDT Wed Mar 12 2008, PeerAddress 5555551234, PeerSubAddress , DisconnectCause 10 , DisconnectText normal call clearing (16), ConnectTime 11:11:35.461 PDT Wed Mar 12 2008, DisconnectTime 11:12:41.071 PDT Wed Mar 12 2008, CallOrigin 2, ChargedUnits 0, InfoType 2, TransmitPackets 3266, TransmitBytes 548688, ReceivePackets 3271, ReceiveBytes 523360

3314821: Mar 12 11:12:41 PDT: %VOIPAAA-5-VOIP_FEAT_HISTORY: FEATURE_VSA=fn:TWC,ft:03/12/2008 11:11:33.282,cgn:5555551234,cdn:3255,frs:0,fid:999029,fcid:94AD2944EF9611DCB414001AA29E1B00,legID:93E9C

3314822: Mar 12 11:12:53 PDT: %VOIPAAA-5-VOIP_CALL_HISTORY: CallLegType 1, ConnectionId 91378552EF9611DC9C41C6A8127CCABC, SetupTime 11:11:27.477 PDT Wed Mar 12 2008, PeerAddress 3225, PeerSubAddress , DisconnectCause 10 , DisconnectText normal call clearing (16), ConnectTime 11:11:41.317 PDT Wed Mar 12 2008, DisconnectTime 11:12:53.747 PDT Wed Mar 12 2008, CallOrigin 2, ChargedUnits 0, InfoType 2, TransmitPackets 0, TransmitBytes 0, ReceivePackets 4052, ReceiveBytes 648320

Try this. Copy this filter to flash on the router, then configure:

logging filter flash:voip_filter.tcl

logging host x.x.x.x filtered

That should prevent undesired messages from making it to your syslog server.

Thanks for the quick reply and the unexpected file no less!

I won't be able to implement it until this weekend, but will let you know.

Thanks much.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: