We have all of our network devices pointing the CiscoWorks and a destination for logs.
I cannot find where the logs are being stored.
I have looked "Alerts and Activity" and "Fault History"
These do not really show anything.
Are the above alerts generated by traps?
Where would I find the results of logs being sent to Ciscoworks and how can I verify the configuration?
If you have your devices logging to the LMS server, then you'll want to look in RME - Reports - Syslog Standard Reports.
Check and make sure the messages make it to syslog.log or syslog_info before checking the GUI for the messages.
Like the syslog.
I did a report and pulled a syslog report on a particular device and aske for the past month.
The devices (network gear) are all pointed to the CiscoWorks server as the syslog server.
Where does Ciscoworks keep the syslog information and how long does it keep it?
The syslog messages are you kept in the Syslog database space within RME.
Check your purge settings to see how long its kept...I believe default is 7 days for purging
Is there anyway to look at the log files directly through a console window when telnet into the Cisco Works Box, and not through the Cisco Works GUI? All the responses I see here seem to refer to the Cisco Works GUI and navigating to logs through menu choices there. I've already gone through Cisco Works and still can't see logs. Does anyone know the direct filepath to where logs are stored and archived so I can see if there are even any logs being generated and stored?
The syslogs are stored in NMSROOT\log\syslog.log on Windows and /var/log/syslog_info on Solaris (by default). Once the messages are written to these files, they are read by the SyslogCollector process. That process performs any necessary filtering. The filtering configuration is pushed down to SyslogCollector from the subscribed SyslogAnalyzer processes. If you look at the NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/filters.dat
file, that will give you a good idea of what filters are active for a given Collector.
All messages that are permitted by the filter configuration are passed up to the interested SyslogAnalyzers. The Analyzers perform any relevant automated actions, and write the messages into the RME database.
Once the messages are purged, does CiscoWorks have the capabilty to pull reports from the purged files?
If so, it would be good to purge more often than not?
Right now the purge job runs once a month and purges items older that 365 days.
No, RME's reports will only operate on messages stored in the RME database. If you backup the log messages to a flat file prior to purging, those messages will not be reportable within RME.
The backup feature is there for those needing to maintain a long audit trail, but not necessarily hold the messages for active reporting. That is, you store messages for two years, but you may never need to look at them unless the federal government issues a subpeona (SOX compliances, for example). In that case, keeping them in the database would be a waste.