changing the syslog engine in Ciscoworks LMS 2.5

[akin_lopez]

hi guys,

is it possible to change the default syslog engine in LMS 2.5 ?

I need to run a syslog server that can display syslog message in realtime and also forward this to an analysis tool.

I don't want to increase the number of syslog server i configured on my devices hence the need for a syslog server that can transparently forward messages (e.g kiwi syslog)

pls tell me if this is possible and how i can do it without conflict with anything on ciscoworks.

[nhabib]

Are you running on Windows or Solaris?

[akin_lopez]

I am running on windows

[nhabib]

This is totally unsupported, but worth a try:

- stop / disable the CiscoWorks Syslog Service (from control panel)

- have Kiwi place all syslog messages in CSCOpx\log\syslog.log

Basically the CW Syslog Analyzer reads the messages from CSCOpx\log\syslog.log and places them in the database.

[akin_lopez]

I will give it a try and give you a feedback.

Thanks

[Joe Clarke]

While this may work in terms of writing the messages to the file, the format may be such that SyslogCollector will not recognize the messages. Our syslog daemon in LMS 2.5 is specially optimized for scalability up to 200 sustained messages per second with bursts to 1000. Additional customizations are on the way.

Given that using Kiwi or any other syslog daemon means you can never open a TAC Service Request about syslog, it would be best to use the third-party syslog daemon on a different server, and rely on our daemon with LMS.