Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

LMS 3.2 Syslog Purge

Dear,

Can anyone explain what purge means in LMS 3.2 like for eg. syslog purge. Does it delete those files or makes a backup. If a backup where to find those syslog purged files?

Thanks,

Aamir

Everyone's tags (4)
3 REPLIES

Re: LMS 3.2 Syslog Purge

when LMS is configured correctly it is doing the basic work like discovery, config collection, inventory collection syslog analysis etc. as jobs running on a scheduled basis. The result of these jobs is stored in the database but as well, details of these jobs are kept as history for each kind of jobs. These results can be of interest for documentation purpose as well as for troubleshooting (i.e. when was inventory collection running successfully the last time for device A?). To maintain the history of these jobs, there are purge jobs which define how long the history of the jobs are kept.
For syslog, all messages arriving at the LMS server are collected in a flat file (windows: NMSROOT\log\syslog.log; solaris: /var/log/syslog_info). Then Syslog Analysis picks up those messages apply the defined syslog filters on those messages to decide which of these messages should be kept (put into the syslog database) and which to drop (do not put into the syslog database). The messages in the syslog database are available through the LMS web interface (e.g. RME > Reports > Report Generator > Sylog Report)
You have to say how long syslog messages should be available in this database (to prevent it from growing uninhibited). This is defined with a syslog purge job where you configure for how many days these messages will be available through the LMS GUI (as I said, nearly everything in LMS is done through jobs...).
If you decide to have a syslog backup (which is optional), the purged messages will be written into a file. These files are stored under NMSROOT\files\rme\syslog (windows, with NMSROOT being the installation path of LMS) and /var/adm/CSCOpx/files/rme/syslog (solaris)

New Member

Re: LMS 3.2 Syslog Purge

So basically if i say syslog purge job 7 days, this means any syslog older than 7 days will be deleted from the database and i will not seem them in the syslog report unless i do syslog backup where the purge files will be written to another file. Is that correct?

Thanks,

Aamir

Re: LMS 3.2 Syslog Purge

Yes, purged syslogs will not appear in any report and it is correct that if you say purge syslog entries older than 7 days, the purge job will remove all syslogs older than 7 days from the syslog database;
But you will not have access to these messages from the GUI anymore no matter if you do a syslog backup or not. The syslog backup is just for archiving purpose and you have to maintain these files yourself (I have seen several servers where these files consume a lot of diskspace over the years). In case you need any info from these files you have to use CLI tools.

Usually I configure syslog to delete messages older than 30 day (some customers even have 60) and then kick them off (no syslog backup configured).

But I maintain a backup of the raw syslog file for at least 1 year (which can be configured with the logrot.pl utility that comes with LMS).

1715
Views
15
Helpful
3
Replies
CreatePlease to create content