Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

CiscoWorks and logging

We have all of our network devices pointing the CiscoWorks and a destination for logs.

I cannot find where the logs are being stored.

I have looked "Alerts and Activity" and "Fault History"

These do not really show anything.

Are the above alerts generated by traps?

Where would I find the results of logs being sent to Ciscoworks and how can I verify the configuration?

9 REPLIES
Cisco Employee

Re: CiscoWorks and logging

If you have your devices logging to the LMS server, then you'll want to look in RME - Reports - Syslog Standard Reports.

Check and make sure the messages make it to syslog.log or syslog_info before checking the GUI for the messages.

New Member

Re: CiscoWorks and logging

Thanks.

Where can I look at the config of the Archives like

Where is it located?

How long does it hold the jobs?

Cisco Employee

Re: CiscoWorks and logging

If you're talking about configs then check under RME - Config Mgmt - Archive Mgmt

Are you talking about Archive Mgmt jobs?

New Member

Re: CiscoWorks and logging

Like the syslog.

I did a report and pulled a syslog report on a particular device and aske for the past month.

The devices (network gear) are all pointed to the CiscoWorks server as the syslog server.

Where does Ciscoworks keep the syslog information and how long does it keep it?

Cisco Employee

Re: CiscoWorks and logging

The syslog messages are you kept in the Syslog database space within RME.

Check your purge settings to see how long its kept...I believe default is 7 days for purging

New Member

Re: CiscoWorks and logging

Is there anyway to look at the log files directly through a console window when telnet into the Cisco Works Box, and not through the Cisco Works GUI? All the responses I see here seem to refer to the Cisco Works GUI and navigating to logs through menu choices there. I've already gone through Cisco Works and still can't see logs. Does anyone know the direct filepath to where logs are stored and archived so I can see if there are even any logs being generated and stored?

~Thanks.

Cisco Employee

Re: CiscoWorks and logging

The syslogs are stored in NMSROOT\log\syslog.log on Windows and /var/log/syslog_info on Solaris (by default). Once the messages are written to these files, they are read by the SyslogCollector process. That process performs any necessary filtering. The filtering configuration is pushed down to SyslogCollector from the subscribed SyslogAnalyzer processes. If you look at the NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/filters.dat

file, that will give you a good idea of what filters are active for a given Collector.

All messages that are permitted by the filter configuration are passed up to the interested SyslogAnalyzers. The Analyzers perform any relevant automated actions, and write the messages into the RME database.

New Member

Re: CiscoWorks and logging

Thanks J,

Once the messages are purged, does CiscoWorks have the capabilty to pull reports from the purged files?

If so, it would be good to purge more often than not?

Right now the purge job runs once a month and purges items older that 365 days.

Cisco Employee

Re: CiscoWorks and logging

No, RME's reports will only operate on messages stored in the RME database. If you backup the log messages to a flat file prior to purging, those messages will not be reportable within RME.

The backup feature is there for those needing to maintain a long audit trail, but not necessarily hold the messages for active reporting. That is, you store messages for two years, but you may never need to look at them unless the federal government issues a subpeona (SOX compliances, for example). In that case, keeping them in the database would be a waste.

704
Views
15
Helpful
9
Replies