10-28-2013 10:18 AM
Hi All,
In a central location i have a ciscoworks syslog collector version 3.5. The issue is not all the logs generated in the device are collected by ciscoworks including the devices connected in LAN. The major issue is on Cisco6500 series switches where i see multiple interface flaps in log but only few are found in syslog.
Regards,
Sathvik
10-30-2013 01:40 AM
Hi Sathvik,
If few of them are coming from the devices other should also cum.
Check if they are getting FILTERED . check the filte settings.
Thanks-
Afroz
10-30-2013 03:21 AM
Hi Aforz,
Thanks for the reply.
I am new to ciscoworks, what i see is im not recieving logs in the syslog.log file. To my understanding there would not be any filtering for that file.
Regards,
Sathvik
10-30-2013 03:33 AM
Hi,
check here Admin > Collection Settings > Syslog > Syslog Collector Status , see if messages are falling under fitered or Invalid
then check the filter:
Admin > Network > Notification and Action Settings > Syslog Message Filters
I would suggest you to create a filter with all * and see if that helps.
you can look at this thread as well:
https://supportforums.cisco.com/thread/2244888?tstart=60
Thanks-
Afroz
[Do rate the useful post]
10-30-2013 06:30 AM
Could you please clariffy if the filtering is for the logs collected in syslog.log or while logs move from syslog.log to syslog.db.
10-30-2013 09:06 AM
yes those filters works after syslog start moving to syslog.db from syslog.log
10-30-2013 09:37 AM
Ok, but the issue is i see the logs getting missed in syslog.log. So this shoud not be related to filtering.
10-30-2013 09:40 AM
ohh..if that is the issue then you need to collect the Packet capture and check if those syslogs are reaching to the LMS server or not , If not then check the issue with the device team.
Thanks-
Afroz
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: