Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

RME 4.0.4 Syslog Help

I'm having some issues with Syslog and I can not get my brain to respond with any intelligable responses, so perhaps some one here could help me. When I initially installed LMS a couple of months ago, Syslog seemed to be operating OK. I could run a report and it'd come up with some information. Mainly Link Up/Down states, but of course I want those filtered out. Well, now I have nothing. If I run ANY of the syslog reports, it comes back with absolutely nothing. So obviously somethings gone wrong somewhere. So I guess the first thing is to figure what I did wrong in the first place so here is what I have:

Collector Status is showing 33,414 filtered and Received 33,536 with 109 Invalid. Doesn't leave a lot of useful information does it.

So on filtering (this is where I get confused):

Message Filters Type: Drop Keep

I have it set to Keep, so does that mean apply filters and keep those caught by filter or what?

Include Interfaces of Selected Devices-YES

The only thing in the actual filter list are the original defaults and they're all set to Enabled.

So I guess I need some explanationg as to what I'm keeping and what I'm filtering or not. I know it's pure user error, but I'm confused. Also, on my devices I have the following set for logging:

logging history errors

logging trap errors

logging facility syslog

logging x.x.x.x

Sound Good?

And if you have any recommendations on Syslog to get the useful information, please let me know.


Cisco Employee

Re: RME 4.0.4 Syslog Help

What is the size of your syslog.log or syslog_info file? When was the last time it was purged?

New Member

Re: RME 4.0.4 Syslog Help

Until this morning, I had it set to Purge records older then 14 days every day. I've since changed that to a week.

the syslog.log file is 95meg and there is deffiantly syslog messages in it. Granted, the majority are link state messages, but some are flapping and vlan mismatches. What do I have set incorrectly that would make them not show up in any syslog generated report?

Cisco Employee

Re: RME 4.0.4 Syslog Help

Do you have message filters for link state or vlan active?

Try the following:

- Select a device that is managed in RME and is sending syslogs to the server

-- go to the cli of the device and enter:

conf t


-- This should send a config change syslog message

-- Verify that you see the message in the syslog.log

-- Then run a report for that device in Syslog Standard reports a few minutes after

Does it appear?

The purge you mention above is not what I was referring to. I meant do you use logrot to clear the syslog.log file periodically?

New Member

Re: RME 4.0.4 Syslog Help

I'm showing all filters are 'Enabled' and messege filter type is now Keep. After looking at my syslog.log file a little closer, I'm seeing that only a few devices are actually reporting anything. Specifically, there is a 3560 in my office I test with and it set for logging, it does not report anything in the syslog.log file on conf changes. Currently, it's logging configuration is as such: logging x.x.x.x

That's it. I had some other options in there but I stripped them out in hopes it'd make a difference. it is logging locally of course and says so many lines of been sent to x.x.x.x. Of course, I'm not seeing them in the syslog.log

As for logrot, no I do not use it. I just got through looking at it and apparently it's now part of the CiscoWorks instead of me having to download it. Where do I set this up now, doesn't seem to conform to the version of manual I downloaded with the program.


New Member

Re: RME 4.0.4 Syslog Help

Looking at you original post, I see that your Message filter Type is set to Keep. My understanding is that this will only keep messages that are defined and enabled in your filter list.