The syslog.log file is being populated with vty login messages. I have message filter setup to track telnet, tty, and * messages. Yet when I generate a report, I dont see any login or vty data.

But is there a way to turn these messages into an event or alert like in the DFM? For instance like the critical messages shown in the alert portlet in the DFM?

No, you cannot turn syslog messages into DFM events. However, you can configure RME syslog automated actions to send you email when certain syslog messages arrive. You can also view the most critical syslog messages by looking at the RME Syslog Alerts portlet.

As for why you're not seeing the messages, please post a sample of the messages showing up in the syslog log file as well as a screenshot showing your filter settings.

Hi,

Thanks. I've set up the email notification.

Please see attached and the sample vty log in the syslog.log.

40w5d: %SYS-5-CONFIG_I: Configured from console by stephena on vty0

I would like to see "stephena" in a report somewhere. Is this possible?

Regards

Rafiek

You may already be seeing this in your Change Audit reports since this is a config change message.

As for the syslog reports, post a screenshot of the RME > Tools > Syslog > Syslog Collector Status screen as well as the NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/filters.dat

file.