Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Syslog messages to CiscoWorks

I have my CiscoWorks defined as my syslog server and I get messages from all of my boxes- just not ALL the messages. The messages are the ones I want (5's and "up") but where I have 5 logged in the last week from a particular device, the log on the device itself has many more. Any ideas??

-Steve

6 REPLIES
Cisco Employee

Re: Syslog messages to CiscoWorks

Are you seeing these messages in the syslog.log or syslog_info files on the server? If not, then you need to look at the device to see if they are sent to the server.

If the messages are in the log file on the server then you need to look at RME to see if filtered or invalid messages are incrementing. If filtered are incrementing then check you syslog message filters to make sure they aren't filtered out

New Member

Re: Syslog messages to CiscoWorks

The messages are being written to the syslog on the server but not appearing in CiscoWorks. There are no filters defined but invalid message counter has increased. Any other ideas?

Thanks.

Steve

Cisco Employee

Re: Syslog messages to CiscoWorks

If the invalid count has increased you need to check and make sure that the devics are actually managed in RME. Also, the invalid messages could be from the daemon manager and not a device at al.

You might want to try the following:

Enable debugs for SyslogAnalyzer under RME - Admin - System Preferences - Loglevel Settings

Then generate a message from a managed device in RME

Check to make sure this messages hits the syslog.log or syslog_info

Once it does, check the daemons.log to see if it was processed (debugs should show this)

New Member

Re: Syslog messages to CiscoWorks

I'm only running CW2.2 with RME 3.5- I don't find System Preferences.

S.

Cisco Employee

Re: Syslog messages to CiscoWorks

For Rme 3.5 debugs are enabled as follows:

To turn on debugging from the command line, use the following syntax:

CSCOpx/bin

pdmsg SyslogAnalyzer: TYP:=DBG VAL:=2

To turn off debugging from the command line, use the following syntax:

> pdmsg SyslogAnalyzer: TYP:=DBG VAL:=4

Listed below is the key to the numbers in the syntax above:

2 is for debugging

3 is for informational messages

4 is for normal logging

The debug output is in the "daemons.log" file for solaris and syslog analyzer.log for

windows.

New Member

Re: Syslog messages to CiscoWorks

The Syslog analyzer was reporting "database error: failed to get message filters." I put a "bogus" filter out there and am now getting messages to come through. The debug never showed up.

166
Views
15
Helpful
6
Replies