cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1050
Views
0
Helpful
10
Replies

RME syslog alerts

oscar.ledesma
Level 1
Level 1

Hello, i need to set up syslog in RME 4.0.6.

Is there any tutorial or a guide to do that?

Thanks

10 Replies 10

Joe Clarke
Cisco Employee
Cisco Employee

Set it up how? Do you want to enable syslogging on the devices, or enable RME to receive syslog messages?

Enable the RME to receive syslog messages. The devices has already been enabled

Nothing needs to be done. RME will listen for syslog messages by default. The messages will be written into NMSROOT\log\syslog.log on Windows. From there, they will be filtered, and inserted into the RME database so that you can run reports.

The RME was installed 3 mounth ago and the NMSROOT\log\syslog.log has 3 Gb of data but when i run the reports, they always are empty. i dont know if there's some filted enabled.

Post a screenshot of RME > Tools > Syslog > Message Filters.

there's 5 filter enabled, all of them keeping syslog messages. i post the RME Home to show that "24 Hour Syslog Severity Summary" always are in 0

This looks okay. Note, that section of the RME Homepage only tracks the most severe messages. I don't know what the c6k filter is, but I'm betting you don't have any S0, S1, or S2 messages. Instead, go to RME > Reports > Report Generator, and run a syslog standard report for all of your devices. What do you get? How is the c6k filter defined? What messages do you see in syslog.log?

this is de filter c6k. As you can see it can't be blocking the syslog messages, and when i run all kind of syslog reports i always get the same, empty reports with 0 records. When i tried to open the syslog.log i couldn't open it because it's too big. It's 3 GB of size

Okay, this is wrong. I think what you really want is:

Facility : *

Severity : *

Mnemonic : *

Description : *

Try modifying your filter, then send some more syslogs, and they should show up in your reports.

Thank you jclarke. You were right, that was the problem, now it is working fine.

Regards

Oscar

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco