Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

LMS 3.1/ Automate script for Syslog failed

Hi,

When LMS on windows received a change cpnfiguration syslog, I would like to forward an email with the difference beetween running and startup config.

I have already create the automate action but the script action doesn't work:

I create a diff.bat script in CSCOpx\files\scripts\syslog folder.

diff.bat contains only one line:

c:\progra~1\CSCOpx\bin\cwcli config compare -u admin -p admin -device %~1 -m elbe@telindus.fr

But it failed, I don't received the mail, but I see that syslog is received by LMS.

When I launch the script in dos command, it works.

here you can find analysordebug.log file.

Thanks, Elisabeth

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: LMS 3.1/ Automate script for Syslog failed

A transparent forwarding source is something like samplicator or syslog-ng which can forward syslog messages from a device to RME without changing the message header or source IP address. There is no software I know of which turns traps into syslog messages, and spoofs the source of the syslog message. However, it would be fairly easy to write a application that does this using, for example, net-snmp's snmptrapd.

9 REPLIES
Cisco Employee

Re: LMS 3.1/ Automate script for Syslog failed

You need to grant the casusers group rights to execute cmd.exe. Windows 2003 SP1 removed rights for all users.

New Member

Re: LMS 3.1/ Automate script for Syslog failed

Hi,

Thanks, now it works with your help!

I noticed that using command c:\progra~1\CSCOpx\bin\cwcli config compare -u admin -p admin -device %~1 -m elbe@telindus.fr give me as result difference between n and n-1 archive config.

But, I would like to compare running/startup and runing/last archive.

How is it possible with compare command or everything else ?

Elisabeth

Cisco Employee

Re: LMS 3.1/ Automate script for Syslog failed

Comparing startup to running is not easily doable from the command line. It would involve traversing the NMSROOT\files\rme\dcma\devicefiles directory to find the matching device. However, assuming that you are using syslog messages to trigger a config archive sync, simply comparing the latest archive to n-1 would suffice. If not, you could do:

cwcli config get -u admin -p admin -device %~1

Once that job completes, then run your compare command.

New Member

Re: LMS 3.1/ Automate script for Syslog failed

In fact I prefer to generate an automated action with change audit. But is seems that %~1 is not defined as device but something like "Syslog triggered Config Collection : VLAN-RUNNING".

Do you think that it exists a variable for device IP or name ?

If not, I will get the config like you mentioned then I will compare in aumomated action with syslog

-----Message d'origine-----

De : lms-marseille@telindus.fr [mailto:lms-marseille@telindus.fr]

Envoyé : vendredi 5 décembre 2008 16:15

À : Elisabeth Bezombes

Objet : RME CLI Results

Hello,

The following is the details of the command execution on "LMS".

Command Executed : cwcli config compare -u admin -p -device Syslog triggered Config Collection : VLAN-RUNNING -m elbe@telindus.fr

Details :

FATAL - DCR Error occurred. Recommended Action:Check whether DCRServer is up and running.

ERROR - Invalid device(s) specified. Recommended Action: 1.Check whether the correct device-name is used. 2.Ensure that the devices are not in suspended/conflicting states. 3.Ensure that the user is authorized to use the devices.

SUMMARY

========

Failed: compare: Failed to obtain any device(s) to work on.

Cisco Employee

Re: LMS 3.1/ Automate script for Syslog failed

You're doing a change audit automated action? I had assumed syslog. You are seeing CSCsr93354, then. I filed this bug requesting more arguments (e.g. the device name) get passed to change audit automated actions. I wrote some code to implement this, but it has not yet been committed to a release. I'm hoping to get it into LMS 3.2 due out next summer.

In the meantime, the only argument passed to a Change Audit automated action is the change description.

New Member

Re: LMS 3.1/ Automate script for Syslog failed

Hi,

You are right, at the begining I worked with syslog. After, I saw that it was possible to generate a script with change audit, so I try ...

Thanks for the bug you have given, I will work with syslog automated action until next LMS version.

I have a last question, tell me if you think I need to create an other thread.

We can't configure security device (firewall) to forward informationnal syslog (config modification)to LMS because thoses devices generate many informationnal syslogs.

Those device can generate a trap (config change) which is send to DFM.

Do you think that we can configure DFM to generate a syslog to lms which is analysed by RME which launch the script diff.bat for sending a mail with conf difference ?

Many thanks, Elisabeth

Cisco Employee

Re: LMS 3.1/ Automate script for Syslog failed

What you want to do is not possible. RME will have to receive the syslog message directly from the device or from a transparent forwarding source. Going through DFM will not work.

New Member

Re: LMS 3.1/ Automate script for Syslog failed

What do you mean by transparent forwarding source ?

Is it possible to use a soft which receive the trap and forward a syslog similar to a config change syslog to rme ?

Cisco Employee

Re: LMS 3.1/ Automate script for Syslog failed

A transparent forwarding source is something like samplicator or syslog-ng which can forward syslog messages from a device to RME without changing the message header or source IP address. There is no software I know of which turns traps into syslog messages, and spoofs the source of the syslog message. However, it would be fairly easy to write a application that does this using, for example, net-snmp's snmptrapd.

279
Views
0
Helpful
9
Replies
CreatePlease to create content