Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Can Win LMS 2.5 receive forwarded messages from another syslog server?

I am currently logging all infrastructure device logs to syslogd on SunOS 5.9. I would like to forward info messages to LMS for change notification. In syslog.conf I have added "local7.info @x.x.x.x" but LMS does not see any of the messages. I have confirmed that the message reaches the Sun box. Any insight?

5 REPLIES
Red

Re: Can Win LMS 2.5 receive forwarded messages from another sysl

Community Member

Re: Can Win LMS 2.5 receive forwarded messages from another sysl

I am unable to come up with any documentation on how this little guy works. All the links on cisco.com point to this page (or similiar). Does anyone have any links?

Would I send my syslog to RSC? Or would I use this as a primary syslogd?

Cisco Employee

Re: Can Win LMS 2.5 receive forwarded messages from another sysl

In this scenario you would send your messages from your devices to the RSC. It would act as a collector and then would forward these messages to a central Syslog Analyzer running full scale RME.

You could have multiple RSC's collecting messages and then all forwarding these messages to one central server where you could run reports

More info on RSC also known as Common Syslog Collector:

http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/cw2000e/e_4_x/4_0_3/u_guide/syslog.htm#wp1185221

Community Member

Re: Can Win LMS 2.5 receive forwarded messages from another sysl

Thanks for the reply.

I'm not really looking to do that as we have our Sun box doing the syslog colllection. We do a bunch of stuff once it gets to that box. I was hoping that I would be able to just forward those specific messgaes on to RME.

I believe syslogd will change the actual syslog message when it forwards on...which would be the problem. Apparently syslog-ng will forward on the original message.

Anyone here already doing that?

Silver

Re: Can Win LMS 2.5 receive forwarded messages from another sysl

We're doing Syslog NG and it doesn't change the origination of the log entry ... a much better solution for log centralization with multivendor inputs.

133
Views
4
Helpful
5
Replies
CrearPor favor para crear contenido