Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Prime2.0 SYSLOG

Last week this forum answered a question I had regarding syslog and how only levels 0 & 1 are logged and there is an unsupported addition that can be added to a particular file.  Not being a Linux guru, would anyone have specific instructions/documentation for that add or would opening a TAC get it done ?

Please advise, thanks.

8 REPLIES
Cisco Employee

Hi,In the last post vinod has

Hi,

In the last post vinod has provided the steps and as he mentioned " this is not  a supported method".

PI 2.1 will have the complete syslogs support AFAIK.

 

======================

need  to modify a file in PI 2.0 to allow prime to accept Syslog messages.
change following file
/opt/CSCOlumos/conf/syslog_sev_filter.xml file (Bold lines have been added here):

<expression op='OR'>
        <!-- Error -->
        <condition field='severity' op='EQUALS' value='0' />
        <condition field='severity' op='EQUALS' value='1' />
        <condition field='severity' op='EQUALS' value='2' />
        <condition field='severity' op='EQUALS' value='3' />
        <condition field='severity' op='EQUALS' value='4' />
        <condition field='severity' op='EQUALS' value='5' />
        <condition field='severity' op='EQUALS' value='6' />

=======================

 

step 1:

vim /opt/CSCOlumos/conf/syslog_sev_filter.xml

 

this will open the file with VIM editor 

Now PRESS the  Insert key

browse to next line of the below Entry

<condition field='severity' op='EQUALS' value='2' />

 

then just copy paste the below entries:

<condition field='severity' op='EQUALS' value='3' />
<condition field='severity' op='EQUALS' value='4' />
<condition field='severity' op='EQUALS' value='5' />
<condition field='severity' op='EQUALS' value='6' />

Now to save the file the key is

 

press ESC then : (colon key)  then wq! 

ESC:wq!

this will save the chnages.

**NOTE: THIS IS NOT CISCO TESTED.

 

Thanks-

Afroz

***Ratings Encourages Contributors ****

Thanks- Afroz [Do rate the useful post] ****Ratings Encourages Contributors ****
New Member

Thanks Afroz,Two questions

Thanks Afroz,

Two questions before I enter this;

1) will improperly coded statements be ignored ?

2) Is there an indication it is complete or a display/show that can be done to check the code that was entered ?

New Member

..after the first command in

..after the first command in root;  is this correct ?

Starting root bash shell ...
ade # /opt/CSCOlumos/conf/syslog_sev_filter.xml

: command not found/syslog_sev_filter.xml: line 1:
/opt/CSCOlumos/conf/syslog_sev_filter.xml: line 2: expression: No such file or directory
: command not found/syslog_sev_filter.xml: line 3:
/opt/CSCOlumos/conf/syslog_sev_filter.xml: line 4: !--: No such file or directory
/opt/CSCOlumos/conf/syslog_sev_filter.xml: line 5: condition: No such file or directory
/opt/CSCOlumos/conf/syslog_sev_filter.xml: line 6: condition: No such file or directory
/opt/CSCOlumos/conf/syslog_sev_filter.xml: line 7: condition: No such file or directory
: command not found/syslog_sev_filter.xml: line 8:
/opt/CSCOlumos/conf/syslog_sev_filter.xml: line 9: /expression: No such file or directory
ade #
ade #

Hall of Fame Super Silver

You left out "more".In Linux,

You left out "more".

In Linux, the "more" command types out the following file on screen, a page at a time.

See http://linux.about.com/od/commands/a/Example-Uses-Of-The-Command-More.htm

Hall of Fame Super Silver

If you don't put it in as

If you don't put it in as noted above, it may or may not work - depends on how badly it's mangled. :)

Simply type "more /opt/CSCOlumos/conf/syslog_sev_filter.xml" to see the resultant edited file.

Afterwards, compare a given's device's local log file with that seen in Prime Infrastructure (assuming the Prime server address has been set as the logging host for that device).

New Member

Thanks Marvi - I'll read the

Thanks Marvi - I'll read the doc and give it another go.  The current syslog file is 30 days - can that be extended to 90 or more  ?

Cisco Employee

Hi,1) will improperly coded

Hi,

1) will improperly coded statements be ignored ?

No , you ignore any commmnent you need to pu # ssymbol in front of it.

2) Is there an indication it is complete or a display/show that can be done to check the code that was entered ?

after you edit the file , you can view the file content with the below command:

cat  /opt/CSCOlumos/conf/syslog_sev_filter.xml

check the content ,they should be look the same way as mentioned in my first and vinod post.

 

Thanks-

Afroz

Thanks- Afroz [Do rate the useful post] ****Ratings Encourages Contributors ****
New Member

...this is where I am - how

...this is where I am - how does one browse as you mention ?

ade # cat /opt/CSCOlumos/conf/syslog_sev_filter.xml

<expression op='OR'>

        <!-- Error -->
        <condition field='severity' op='EQUALS' value='0' />
        <condition field='severity' op='EQUALS' value='1' />
        <condition field='severity' op='EQUALS' value='2' />
       
</expression>
        ade # vi

~                                                                                                              
~            

1180
Views
5
Helpful
8
Replies
CreatePlease login to create content