Syslog analysis in RME no data

[boonteongng]

I configure a cisco router to send syslog back to the RME with following;

logging on

logging <RME server iP>

logging trap notifications

The server is a solaris 8

I can see the syslog captured in /var/log/syslog_info.

However, when I tried to create report, I received a message :no data found

[wodriscoll]

hi,

add to your config

snmp-server community *** RO

snmp-server community *** RW

and the important bit

snmp-server host (ip address) trap (community name)

for some reason this needs to be done....(and yes it should have nothing to do with it..)

HTH steve

[boonteongng]

I add in the snmp-server host (ip address) trap but still the same.

I can see the syslog messages in the server's /var/log/syslog_info. However, the report still shows no record.

[s.coyle]

Seen this before, many times.

Usually due to RME not 'recognising' the source of the syslog, even though the device IS managed.

Have a look in the unexpected syslog report to see if the syslogs have been received OK, and note the addess they came.

If the syslogs are present, config your switches/routers to issue all future syslogs with the same ip address as RME thinks the device is managed from.

For example, if the device is in RME under the address 10.1.1.1 (which corresponds to the device E2 interface) then use something like the following on the switch/router:

logging source-interface Ethernet 2

This should ensure that the syslog is sent from the same address as the RME 'management' address of the device, and hence RME will 'recognise' it.

If a DNS name is used in RME then check that the ip address returned by DNS is the same as the source-interface, as above.

[wodriscoll]

Bugger .....he is wright...

i completely forgot that as i had the same problem 4 mnths ago myslef and fixed it that way ...

what i did was delete any suspect device`s and re-add them as loopback`s

best to go that way as a loopback int doesnt care if you reconfig your network you can still monitor things

hth