Syslog Analyzer

[londint]

My Syslog server is set on all on our switches and routers but i can see my syslog.log fills up to 17Mb.

But I cannot pick up any in the RME Syslog Analyzer. What is wrong?.

These are my settings:

Logging buffer size: 500

timestamp option: enabled

Logging history size: 1

Logging console: enabled

Logging telnet: enabled

Logging server: enabled

{?.?.?.?}

server facility: LOCAL7

server severity: debugging(7)

Current Logging Session: enabled

Thanks

[milan.kulik]

Hi,

have you tried to open the syslog.log file manually and check if are there the correct syslog messages in it?

Regards,

Milan

[londint]

Thanks

I have checked and entries in a switch such as

2004 Apr 22 10:00:25 BST +01:00 %PAGP-5-PORTTOSTP:Port 6/27 joined bridge port 6

/27 which is a pagp set at 5 and I have

Facility Default Severity Current Session Severity

------------- ----------------------- -------

pagp 5 5

and

Logging buffer size: 500

timestamp option: enabled

Logging history size: 1

Logging console: enabled

Logging telnet: enabled

Logging server: enabled

{?.?.?.?}

server facility: LOCAL7

server severity: debugging(7)

Current Logging Session: enabled

I dont see it at all in the syslog drawer in the RME?

Thanks

[milan.kulik]

Just to be clear:

Did you open the syslog.log file on the Ciscoworks server and found the syslog messages from the switch in it?

Does the {?.?.?.?} in your output just replace the IP address of your Ciscoworks server?

If you go to RME -> Syslog Analysis -> Standard reports -> All devices

do you see the switch on the list or not?

If yes, selecting the switch from the list and displaying All messages from the last week e.g. displays just empty screen?

Regards,

Milan

[Craig Norborg]

I've had a similar (perhaps the same) problem where my syslog.log fills up and doesn't expire properly. Then after awhile the RME Syslog Analyzer stops showing anything in it until I go in and shut down Ciscoworks, manually prune a bunch of messages from the syslog file, and restart Ciscoworks. At that time it starts behaving better for awhile. Haven't figured out whats wrong yet...

[milan.kulik]

Hi,

are you using logrot to clean the syslog file?

Regards,

Milan