Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Syslog server

For some reason I couldn't see the debug syslog on the LMS2.5. I have enabled the level 7 on the router already. Is it filtered by collector by default?

Thanks

7 REPLIES
Red

Re: Syslog server

By default, severity 7 messages are filtered out in LMS 2.5

To change the setting, go to RME -> Tools -> Syslog -> Message Filters, check the Severity 7 Message Filter box and click on Enable/Disable

Cisco Employee

Re: Syslog server

You can go to RME->Tools->Syslog->Message Filters and see if Severity 7 Message Filter is enabled or not.

It is usually enabled by default

Dave

New Member

Re: Syslog server

I went in and disabled the filter. But still didn't see the debug messages. Weird. Anywhere should I click apply or just click the enable/disable?

Thanks

Cisco Employee

Re: Syslog server

Should be good enough to just disable the filter. you could also delete the filter, but disable should be enough. Are there any other filters there that could be blocking messages you expect to see?

Check the syslog.log or syslog_info to see if the messages are in there and then go to Syslog Collector Status and see if messages are forwarded, invalid, filtered, dropped or received.

Cisco Employee

Re: Syslog server

At least on the Solaris platform, the /etc/syslog.conf file must be modified so the default of local7.info now uses local7.debug. That would allow Solaris to receive and filter the messages to syslog_info.

Cisco Employee

Re: Syslog server

IOS debug messages are not EMBLEM compliant and so, RME will not not process these messages.

Pusuing internally to understand what the future holds.

Blue

Re: Syslog server

Yup, that's what one of the senior TAC engineers told me when I ran into a bout of trouble with Syslog Analysis. Turned out someone modified local7.info to local7.debug.

152
Views
4
Helpful
7
Replies