Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

LMS 2.5.1 RME Syslog Collector; can it forward?

I am using the Syslog Collector that is installed when you install RME. All of my devices are currently configured to log to the CiscoWorks server. Is there a way to have the RME Syslog Collector forward syslogs from devices on to another independent syslog collector after it has filtered the messages? (on top of passing the syslogs on to the RME syslog analyzer)

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: LMS 2.5.1 RME Syslog Collector; can it forward?

I'll bet you're on Windows 2003. In that case, you need to edit the permissions on C:\windows\system32\cmd.exe to allow the casusers group to execute cmd.exe.

8 REPLIES
Cisco Employee

Re: LMS 2.5.1 RME Syslog Collector; can it forward?

You can subscribe multiple SyslogAnalyzers to one SyslogCollector (i.e. multiple RME servers can use one SyslogCollector each with different filters), but you cannot have the Collector forward messages to another generic syslog receptor.

However, you can use SyslogAnalyzer to then forward the syslog messages on to a different server as an automated action. See http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=Network%20Management&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1ddcf91c for more details on how to do that.

New Member

Re: LMS 2.5.1 RME Syslog Collector; can it forward?

Joe,

I have reviewed this other string and have followed it, however, I am still having problems.

I have created a file D:\apps\CSCOpx\files\scripts\syslog\syslog.pl that contains:

#!/opt/CSCOpx/bin/perl

use strict;

use Sys::Syslog qw(:DEFAULT setlogsock);

my $msg = $ARGV[0];

setlogsock('inet');

$Sys::Syslog::host = '172.19.105.99';

syslog('info|local7', $msg);

closelog;

I have also created a batch file D:\apps\CSCOpx\files\scripts\syslog\syslog.bat that contains:

@ECHO OFF

D:\apps\CSCOpx\bin\perl.exe D:\apps\CSCOpx\files\scripts\syslog\syslog.pl "%~2"

I have an automated action configured and it looks like:

Name: Forward syslogs

Devices: 10.110.1.24

State: Enabled

Parameters: d:/apps/CSCOpx/files/scripts/syslog/syslog.bat

Action Type: Script

Messages: *-*-*-*:*

I have set up the log level for SyslogAnalyzer to Debug. But when a syslog is recieved from this specific device here is what shows up in the AnalyzerDebug.log:

[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],About to execute "d:/apps/CSCOpx/files/scripts/syslog/syslog.bat"

[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],Command line after substitution : "d:/apps/CSCOpx/files/scripts/syslog/syslog.bat" "Device" "Aug 02 14:02:21 xxx.xxx.xxx.xxx 46263: .Aug 2 14:00:54.381: %ISDN-6-CONNECT: Interface Serial0/2/0:1 is now connected to XXXXXXXXXX N/A"

[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],Will execute "d:/apps/CSCOpx/files/scripts/syslog/syslog.bat" "Device" "Aug 02 14:02:21 xxx.xxx.xxx.xxx 46263: .Aug 2 14:00:54.381: %ISDN-6-CONNECT: Interface Serial0/2/0:1 is now connected to XXXXXXXXXX N/A"

[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],The String to be Parsed : "d:/apps/CSCOpx/files/scripts/syslog/syslog.bat" "Device" "Aug 02 14:02:21 xxx.xxx.xxx.xxx 46263: .Aug 2 14:00:54.381: %ISDN-6-CONNECT: Interface Serial0/2/0:1 is now connected to XXXXXXXXXX N/A"

[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],d:/apps/CSCOpx/files/scripts/syslog/syslog.bat

[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],Device

[ Thu Aug 02 14:02:23 CDT 2007 ],DEBUG,[Thread-1],Aug 02 14:02:21 71.153.201.242 46263: .Aug 2 14:00:54.381: %ISDN-6-CONNECT: Interface Serial0/2/0:1 is now connected to XXXXXXXXXX N/A

[ Thu Aug 02 14:02:23 CDT 2007 ],ERROR,[Thread-1],Unable to execute script. Exception is -

java.io.IOException: CreateProcess: d:/apps/CSCOpx/files/scripts/syslog/syslog.bat "Device" "Aug 02 14:02:21 xxx.xxx.xxx.xxx 46263: .Aug 2 14:00:54.381: %ISDN-6-CONNECT: Interface Serial0/2/0:1 is now connected to XXXXXXXXXX N/A" error=5

at java.lang.Win32Process.create(Native Method)

at java.lang.Win32Process.(Win32Process.java:68)

at java.lang.Runtime.execInternal(Native Method)

at java.lang.Runtime.exec(Runtime.java:566)

at java.lang.Runtime.exec(Runtime.java:491)

at java.lang.Runtime.exec(Runtime.java:457)

at com.cisco.nm.rmeng.sa.actions.RmeSaScriptHandler.runScript(RmeSaScriptHandler.java:389)

at com.cisco.nm.rmeng.sa.actions.RmeSaScriptHandler.act(RmeSaScriptHandler.java:179)

at com.cisco.nm.rmeng.fcss.actions.FcssActionProcessor.handOff(FcssActionProcessor.java:131)

at com.cisco.nm.rmeng.fcss.actions.FcssActionProcessor.process(FcssActionProcessor.java:113)

at com.cisco.nm.rmeng.fcss.actions.FcssActionProcessor.run(FcssActionProcessor.java:155)

Can you please give some insite as to what might be wrong? I am running LMS 2.5.1 on Windows with RME 4.0.4

Cisco Employee

Re: LMS 2.5.1 RME Syslog Collector; can it forward?

I'll bet you're on Windows 2003. In that case, you need to edit the permissions on C:\windows\system32\cmd.exe to allow the casusers group to execute cmd.exe.

New Member

Re: LMS 2.5.1 RME Syslog Collector; can it forward?

Thanks! After adding read and execute to cmd.exe it is working great!

New Member

Re: LMS 2.5.1 RME Syslog Collector; can it forward?

Hi Joe,

i have created the same *.bat and *.pl as Michael, but i become the error

syslog: expected both priority and mask at d:\progra~1\CSCOpx\files\scripts\sysl

og\outofbox.pl line 9

Cisco Employee

Re: LMS 2.5.1 RME Syslog Collector; can it forward?

You need to specify an argument to the Perl script. If you run it without any arguments, you will get this error. If you have used the exact same scripts, then RME will call the Perl script correctly. If you are trying to test it by running it manually, you will need to run it as:

D:\progra~1\cscopx\bin\perl d:\progra~1\CSCOpx\files\scripts\sysl

og\outofbox.pl "Hello World"

That should send a syslog message with the contents "Hello World" to your syslog server.

New Member

Re: LMS 2.5.1 RME Syslog Collector; can it forward?

Thanks. Can i test it this script only at a syslog server ?

New Member

Re: LMS 2.5.1 RME Syslog Collector; can it forward?

that's been taken care of now, thanks for your help

270
Views
0
Helpful
8
Replies
CreatePlease to create content