Syslog server

[ciscoforum]

For some reason I couldn't see the debug syslog on the LMS2.5. I have enabled the level 7 on the router already. Is it filtered by collector by default?

Thanks

[nhabib]

By default, severity 7 messages are filtered out in LMS 2.5

To change the setting, go to RME -> Tools -> Syslog -> Message Filters, check the Severity 7 Message Filter box and click on Enable/Disable

[David Stanford]

You can go to RME->Tools->Syslog->Message Filters and see if Severity 7 Message Filter is enabled or not.

It is usually enabled by default

Dave

[ciscoforum]

I went in and disabled the filter. But still didn't see the debug messages. Weird. Anywhere should I click apply or just click the enable/disable?

Thanks

[David Stanford]

Should be good enough to just disable the filter. you could also delete the filter, but disable should be enough. Are there any other filters there that could be blocking messages you expect to see?

Check the syslog.log or syslog_info to see if the messages are in there and then go to Syslog Collector Status and see if messages are forwarded, invalid, filtered, dropped or received.

[Jason Davis]

At least on the Solaris platform, the /etc/syslog.conf file must be modified so the default of local7.info now uses local7.debug. That would allow Solaris to receive and filter the messages to syslog_info.

[Palani Mohan]

IOS debug messages are not EMBLEM compliant and so, RME will not not process these messages.

Pusuing internally to understand what the future holds.

[yjdabear]

Yup, that's what one of the senior TAC engineers told me when I ran into a bout of trouble with Syslog Analysis. Turned out someone modified local7.info to local7.debug.