Ciscoworks syslog collector issue

[sathvik k v]

Hi All,

In a central location i have a ciscoworks syslog collector version 3.5. The issue is not all the logs generated in the device are collected by  ciscoworks including the devices connected in LAN. The major issue is on Cisco6500 series switches where i see multiple interface flaps in log but only few are found in syslog.

Regards,

Sathvik

[AFROJ AHMAD]

Hi Sathvik,

If few of them are coming from the devices other should also cum.

Check if they are getting FILTERED . check the filte settings.

Thanks-

Afroz

[sathvik k v]

Hi Aforz,

Thanks for the reply.

I am new to ciscoworks, what i see is im not recieving logs in the syslog.log file. To my understanding there would not be any filtering for that file.

Regards,

Sathvik

[AFROJ AHMAD]

Hi,

check  here Admin > Collection Settings > Syslog > Syslog Collector Status  , see if messages are falling under fitered or Invalid

then check the filter:

Admin > Network > Notification and Action Settings > Syslog Message Filters

I would suggest you to create a filter with all  *  and see if that helps.

you can look at this thread  as well:

https://supportforums.cisco.com/thread/2244888?tstart=60

Thanks-

Afroz

[Do rate the useful post]

[sathvik k v]

Could you please clariffy if the filtering is for the logs collected in syslog.log or while logs move from  syslog.log to syslog.db.

[AFROJ AHMAD]

yes those filters works after syslog start moving to syslog.db from syslog.log

[sathvik k v]

Ok, but the issue is i see the logs getting missed in syslog.log. So this shoud not be related to filtering.

[AFROJ AHMAD]

ohh..if that is the issue then you need to collect the Packet capture  and check if those syslogs are reaching to the LMS server or not , If not then check the issue with the device team.

Thanks-

Afroz