I have setup LMS2.5.1 to send emails upon reception of certain syslog messages.
For every message received, an email is triggered. If there is a faulty device, thousands of emails are triggered for the same message.
Is Cisco by any chance going to implement message correlation in a future CiscoWorks release, so that syslog message filters manage the received messages more intelligently, and that one's mailbox will not be flooded by thousands of emails for the same message?
This is not currently planned. However, by using the script Automated Action instead of the email, you could code your own correlation engine to reduce the flood of messages. Newer versions of IOS also offer the ability to manipulate syslog messages directly on the device using rate limiting and the Embedded Syslog Manager.
I have not heard of any AA scripts to do message correlation. Hopefully, if any one has written such a script, they would participate in this forum, and be willing to share.
As a basic starting point, you could do simple message counting. Keep a cache file of devices, messages, the message count, and the start time of your "roll-up" window. That way, you would only get one of each message from each device in the desired window.
I went ahead and coded my simply counting example. Attached is the AA script and the .sh and .bat wrappers for Solaris and Windows. You will need to modify some of the values in msg_rollup.pl as well as install the sampleEmailScript.pl into NMSROOT/bin (note: this is the same sampleEmailScript.pl that shipped with LMS 2.2).
This should give you a good starting point. Of course, these files are distributed as is with no support. The msg_rollup.pl script is BSD-licensed.
Question We run asr9001 with XR 6.1.3, and we have a very long delay to
login w/ SSH 1 or 2 to the device compare to IOS device. After
investigation, the there is 1s delay between the client KEXDH_INIT and
the server (XR) KEXDH_REPLY. After debug ssh serv...
Introduction The purpose of this document is to demonstrate the Open
Shortest Path First (OSPF) behavior when the V-bit (Virtual-link bit) is
present in a non-backbone area. The V-bit is signaled in Type-1 LSA only
if the router is the endpoint of one or ...
Hi, I am seeing quite a few issues with patch install and wanted to
share my experience and workaround to this. Login to admin via CLI, then
access root with the “shell” command Issue “df –h” and you’ll probably
see the following directory full or nearly ...