Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

RME syslog -> event de-duplication w/ RSAC?

hi,

In a deployment of LMS v3.1, let's say we have a WAN environment where log information is considered critical.

For that purpose, device syslog is sent to two site-local destinations, RSAC#1 and RSAC#2 which achieves the requisite degree of resiliency.

If a central RME subscribes to both RSAC, are syslog events de-duplicated today?

If not...

i) comment on what issues this might pose, especially if they are not cosmetic, and

ii) could de-duplication be put forth for consideration on the feature roadmap.

Curious.

thanks,

Rob.

1 REPLY
Cisco Employee

Re: RME syslog -> event de-duplication w/ RSAC?

Message de-duplication is currently not done. The idea with RSAC was to offload syslog filtering from the central server as well as provide distributed syslog destinations which could feed filtered messages back to a centralized database using a secure protocol.

1. The biggest concern is with Change Audit and config/inventory fetching. Depending on the delay in the network, and in the processing of the messages, RME may try to fetch the config or inventory from the same device multiple times in succession. This puts an unnecessary burden both on RME and the devices.

2. Absolutely. This is not on the roadmap for LMS 3.2/RME 4.3, but it could be added via a PERS from your account team. I think it would make a good feature.

113
Views
0
Helpful
1
Replies
CreatePlease login to create content