Joe Clarke Wed, 07/29/2009 - 11:58
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Set it up how? Do you want to enable syslogging on the devices, or enable RME to receive syslog messages?

oscar.ledesma Wed, 07/29/2009 - 12:09
User Badges:

Enable the RME to receive syslog messages. The devices has already been enabled

Joe Clarke Wed, 07/29/2009 - 12:16
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Nothing needs to be done. RME will listen for syslog messages by default. The messages will be written into NMSROOT\log\syslog.log on Windows. From there, they will be filtered, and inserted into the RME database so that you can run reports.

oscar.ledesma Wed, 07/29/2009 - 12:24
User Badges:

The RME was installed 3 mounth ago and the NMSROOT\log\syslog.log has 3 Gb of data but when i run the reports, they always are empty. i dont know if there's some filted enabled.

Joe Clarke Wed, 07/29/2009 - 12:27
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Post a screenshot of RME > Tools > Syslog > Message Filters.

oscar.ledesma Wed, 07/29/2009 - 12:43
User Badges:

there's 5 filter enabled, all of them keeping syslog messages. i post the RME Home to show that "24 Hour Syslog Severity Summary" always are in 0



Attachment: 
Joe Clarke Wed, 07/29/2009 - 12:55
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

This looks okay. Note, that section of the RME Homepage only tracks the most severe messages. I don't know what the c6k filter is, but I'm betting you don't have any S0, S1, or S2 messages. Instead, go to RME > Reports > Report Generator, and run a syslog standard report for all of your devices. What do you get? How is the c6k filter defined? What messages do you see in syslog.log?

oscar.ledesma Wed, 07/29/2009 - 13:19
User Badges:

this is de filter c6k. As you can see it can't be blocking the syslog messages, and when i run all kind of syslog reports i always get the same, empty reports with 0 records. When i tried to open the syslog.log i couldn't open it because it's too big. It's 3 GB of size



Attachment: 
Joe Clarke Wed, 07/29/2009 - 13:28
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Okay, this is wrong. I think what you really want is:


Facility : *

Severity : *

Mnemonic : *

Description : *


Try modifying your filter, then send some more syslogs, and they should show up in your reports.

oscar.ledesma Thu, 07/30/2009 - 05:24
User Badges:

Thank you jclarke. You were right, that was the problem, now it is working fine.

Regards

Oscar

Actions

This Discussion