LMS: syslog notifications missing

Wassim Aouadi · ‎03-29-2012

Hi,

I configured syslog to send email notifications when OSPF neighborship fluctuates. For many devices, things are ok. For one device, I only receive "OSPF neighborship FULL" only.

Here's the logging configuration on the device:

Console logging: level debugging, 5717 messages logged, xml disabled,

filtering disabled

Monitor logging: level debugging, 4460 messages logged, xml disabled,

filtering disabled

Buffer logging: level informational, 16 messages logged, xml disabled,

filtering disabled

Exception Logging: size (4096 bytes)

Count and timestamp logging messages: disabled

Persistent logging: disabled

Trap logging: level informational, 342 message lines logged

Logging to 172.16.10.3 (udp port 514, audit disabled,

authentication disabled, encryption disabled, link up),

342 message lines logged,

0 message lines rate-limited,

0 message lines dropped-by-MD,

xml disabled, sequence number disabled

filtering disabled

Syslog Collector Forwarded messages counter increments whenever OSPF neighborship fluctuates.

Any idea?

Wass

Vinod Arya · ‎03-29-2012

Hi Wass,

You may have to see if you generate the 24 hour report that message comes in report for that device. if so, check your Automated action as per the Actual Syslog Message if configured properly.

-Thanks

-Thanks Vinod **Rating Encourages contributors, and its really free. **

Wassim Aouadi · ‎03-30-2012

Hi,

On my Outlook client:

- I receive no mails indicating that OSPF is down on the primary interface (serial0/1/0)

- I receive emails indicating that OSPF is up on the primary interface

- I receive emails indicating that OSPF is up/down on the backup interface(BVI1)

Syslog 24h report shows only OSPF neighborship full for ser0/1/0 (please see LMS report screenshot).

On the device, buffer logs show both OSPF neighborship full and down for ser0/1/0:

*Mar 29 17:13:22.737 UTC: %LINK-3-UPDOWN: Interface Serial0/1/0, changed state to up

*Mar 29 17:13:22.769 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1/0, changed state to up

*Mar 29 17:13:22.829 UTC: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.200.145 on Serial0/1/0 from LOADING to FULL, Loading Done

*Mar 29 17:14:45.645 UTC: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.200.145 on Serial0/1/0 from FULL to DOWN, Neighbor Down: Interface down or detached

*Mar 29 17:14:47.645 UTC: %LINK-5-CHANGED: Interface Serial0/1/0, changed state to administratively down

*Mar 29 17:14:47.649 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1/0, changed state to down

*Mar 29 17:16:51.473 UTC: %LINK-3-UPDOWN: Interface Serial0/1/0, changed state to up

*Mar 29 17:16:51.505 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1/0, changed state to up

*Mar 29 17:16:51.565 UTC: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.200.145 on Serial0/1/0 from LOADING to FULL, Loading Done

*Mar 29 17:17:50.233 UTC: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.200.145 on Serial0/1/0 from FULL to DOWN, Neighbor Down: Interface down or detached

*Mar 29 17:17:52.221 UTC: %LINK-5-CHANGED: Interface Serial0/1/0, changed state to administratively down

*Mar 29 17:17:52.225 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1/0, changed state to down

*Mar 29 17:20:21.393 UTC: %LINK-3-UPDOWN: Interface Serial0/1/0, changed state to up

*Mar 29 17:20:21.425 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1/0, changed state to up

*Mar 29 17:20:21.485 UTC: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.200.145 on Serial0/1/0 from LOADING to FULL, Loading Done

*Mar 29 17:20:23.757 UTC: %SYS-5-CONFIG_I: Configured from console by wassim on vty0 (10.100.7.2)

*Mar 29 17:23:33.841 UTC: %SYS-6-EXIT_CONFIG: User wassim has exited tty session 388(10.100.7.2)

*Mar 29 17:39:31.021 UTC: %SYS-5-CONFIG_I: Configured from console by wassim on vty0 (10.100.7.2)

*Mar 29 17:40:26.009 UTC: %SYS-6-EXIT_CONFIG: User wassim has exited tty session 388(10.100.7.2)

*Mar 29 17:43:42.065 UTC: %SYS-5-CONFIG_I: Configured from tftp://172.16.10.3/20120329183739553-10.101.18.126.cfg by console

*Mar 29 17:49:14.281 UTC: %SYS-6-EXIT_CONFIG: User wassim has exited tty session 389(10.100.7.2)

*Mar 29 17:50:35.413 UTC: %SYS-6-EXIT_CONFIG: User wassim has exited tty session 390(10.100.7.2)

Here is the device config:

logging source-interface GigabitEthernet0/0.1900

logging 172.16.10.3

So the device buffer has it all, however LMS reports only part of the OSPF logs.

Wassim Aouadi · ‎04-05-2012

up