Syslog messages to CiscoWorks

[f1jsb79]

I have my CiscoWorks defined as my syslog server and I get messages from all of my boxes- just not ALL the messages. The messages are the ones I want (5's and "up") but where I have 5 logged in the last week from a particular device, the log on the device itself has many more. Any ideas??

-Steve

[David Stanford]

Are you seeing these messages in the syslog.log or syslog_info files on the server? If not, then you need to look at the device to see if they are sent to the server.

If the messages are in the log file on the server then you need to look at RME to see if filtered or invalid messages are incrementing. If filtered are incrementing then check you syslog message filters to make sure they aren't filtered out

[f1jsb79]

The messages are being written to the syslog on the server but not appearing in CiscoWorks. There are no filters defined but invalid message counter has increased. Any other ideas?

Thanks.

Steve

[David Stanford]

If the invalid count has increased you need to check and make sure that the devics are actually managed in RME. Also, the invalid messages could be from the daemon manager and not a device at al.

You might want to try the following:

Enable debugs for SyslogAnalyzer under RME - Admin - System Preferences - Loglevel Settings

Then generate a message from a managed device in RME

Check to make sure this messages hits the syslog.log or syslog_info

Once it does, check the daemons.log to see if it was processed (debugs should show this)

[f1jsb79]

I'm only running CW2.2 with RME 3.5- I don't find System Preferences.

S.

[David Stanford]

For Rme 3.5 debugs are enabled as follows:

To turn on debugging from the command line, use the following syntax:

CSCOpx/bin

pdmsg SyslogAnalyzer: TYP:=DBG VAL:=2

To turn off debugging from the command line, use the following syntax:

> pdmsg SyslogAnalyzer: TYP:=DBG VAL:=4

Listed below is the key to the numbers in the syntax above:

2 is for debugging

3 is for informational messages

4 is for normal logging

The debug output is in the "daemons.log" file for solaris and syslog analyzer.log for

windows.

[f1jsb79]

The Syslog analyzer was reporting "database error: failed to get message filters." I put a "bogus" filter out there and am now getting messages to come through. The debug never showed up.