Prime2.0 SYSLOG

[SpongeRob]

Last week this forum answered a question I had regarding syslog and how only levels 0 & 1 are logged and there is an unsupported addition that can be added to a particular file.  Not being a Linux guru, would anyone have specific instructions/documentation for that add or would opening a TAC get it done ?

Please advise, thanks.

[AFROJ AHMAD]

Hi,

In the last post vinod has provided the steps and as he mentioned " this is not  a supported method".

PI 2.1 will have the complete syslogs support AFAIK.

======================

need  to modify a file in PI 2.0 to allow prime to accept Syslog messages.
change following file
/opt/CSCOlumos/conf/syslog_sev_filter.xml file (Bold lines have been added here):

<expression op='OR'>
        <!-- Error -->
        <condition field='severity' op='EQUALS' value='0' />
        <condition field='severity' op='EQUALS' value='1' />
        <condition field='severity' op='EQUALS' value='2' />
        <condition field='severity' op='EQUALS' value='3' />
        <condition field='severity' op='EQUALS' value='4' />
        <condition field='severity' op='EQUALS' value='5' />
        <condition field='severity' op='EQUALS' value='6' />

=======================

step 1:

vim /opt/CSCOlumos/conf/syslog_sev_filter.xml

this will open the file with VIM editor 

Now PRESS the  Insert key

browse to next line of the below Entry

<condition field='severity' op='EQUALS' value='2' />

then just copy paste the below entries:

<condition field='severity' op='EQUALS' value='3' />
<condition field='severity' op='EQUALS' value='4' />
<condition field='severity' op='EQUALS' value='5' />
<condition field='severity' op='EQUALS' value='6' />

Now to save the file the key is

press ESC then : (colon key)  then wq! 

ESC:wq!

this will save the chnages.

**NOTE: THIS IS NOT CISCO TESTED.

Thanks-

Afroz

***Ratings Encourages Contributors ****

[SpongeRob]

Thanks Afroz,

Two questions before I enter this;

1) will improperly coded statements be ignored ?

2) Is there an indication it is complete or a display/show that can be done to check the code that was entered ?

[SpongeRob]

..after the first command in root;  is this correct ?

Starting root bash shell ...
ade # /opt/CSCOlumos/conf/syslog_sev_filter.xml

: command not found/syslog_sev_filter.xml: line 1:
/opt/CSCOlumos/conf/syslog_sev_filter.xml: line 2: expression: No such file or directory
: command not found/syslog_sev_filter.xml: line 3:
/opt/CSCOlumos/conf/syslog_sev_filter.xml: line 4: !--: No such file or directory
/opt/CSCOlumos/conf/syslog_sev_filter.xml: line 5: condition: No such file or directory
/opt/CSCOlumos/conf/syslog_sev_filter.xml: line 6: condition: No such file or directory
/opt/CSCOlumos/conf/syslog_sev_filter.xml: line 7: condition: No such file or directory
: command not found/syslog_sev_filter.xml: line 8:
/opt/CSCOlumos/conf/syslog_sev_filter.xml: line 9: /expression: No such file or directory
ade #
ade #

[Marvin Rhoads]

You left out "more".

In Linux, the "more" command types out the following file on screen, a page at a time.

See http://linux.about.com/od/commands/a/Example-Uses-Of-The-Command-More.htm

[Marvin Rhoads]

If you don't put it in as noted above, it may or may not work - depends on how badly it's mangled. :)

Simply type "more /opt/CSCOlumos/conf/syslog_sev_filter.xml" to see the resultant edited file.

Afterwards, compare a given's device's local log file with that seen in Prime Infrastructure (assuming the Prime server address has been set as the logging host for that device).

[SpongeRob]

Thanks Marvi - I'll read the doc and give it another go.  The current syslog file is 30 days - can that be extended to 90 or more  ?

[AFROJ AHMAD]

Hi,

1) will improperly coded statements be ignored ?

No , you ignore any commmnent you need to pu # ssymbol in front of it.

2) Is there an indication it is complete or a display/show that can be done to check the code that was entered ?

after you edit the file , you can view the file content with the below command:

cat  /opt/CSCOlumos/conf/syslog_sev_filter.xml

check the content ,they should be look the same way as mentioned in my first and vinod post.

Thanks-

Afroz

[SpongeRob]

...this is where I am - how does one browse as you mention ?

ade # cat /opt/CSCOlumos/conf/syslog_sev_filter.xml

<expression op='OR'>

        <!-- Error -->
        <condition field='severity' op='EQUALS' value='0' />
        <condition field='severity' op='EQUALS' value='1' />
        <condition field='severity' op='EQUALS' value='2' />
       
</expression>
        ade # vi

~                                                                                                              
~