Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Syslog Automated Action

Hi!

I have CW2k 4th ed. with RME 3.3.

In the Syslog Analysis i've been trying to create an Automated Action that runs a perl script. The problem is that nothing happens!

The filter i specify is *-*-*-* which should trigger on all mesages? I've also tried a filter with SYS-*-5-CONFIG_I which should trigger on all the config changes.

The syslog messages is inserted in the syslog.log file, but the action is not triggered.

The command line i specify is "perl x:\script\test.pl"

Can anyone help me?

Tommy Walderhaug

11 REPLIES
Community Member

Re: Syslog Automated Action

Include the entire path for perl too and make sure the action is enabled

Community Member

Re: Syslog Automated Action

Tried that. Still not working. Also tried to run the script manually from a command line and that works fine.

Community Member

Re: Syslog Automated Action

Here's one that works for me. I had to add the specific path for the script because it didn't work with a path variable when called from CW2k:

perl d:\progra~1\cscopx\cgi-bin\sysloga\sampleEmailScript.pl -text_message Test -email_ids xxx@x.x,xxx@x.x -subject "testing" -from cwks@xxx.com -sender cwks@xxx.com -smtp x.x.x.x

I also had to add the "-sender" field because qmail refused to forward, and bounced it, without it...our email police said something about rfc compliance.

Community Member

Re: Syslog Automated Action

I'm also using RME 3.4. While none of this may help you, I thought showing one that "does" work might.

Cisco Employee

Re: Syslog Automated Action

Try something besides perl to eliminate that first. Try a script/batch file that creates a file or "dir > c:\test.txt".

If you find the file, you know the event is being triggered, and you can work on the balance of the problem (perl script, pathing, etc).

I'm assuming you can see the events you are trying to trigger on coming in to CW2k and the \CSCOpx\log\syslog.log log file, right?

Community Member

Re: Syslog Automated Action

I did try to run a batch file, but nothing happens. The syslog.log file is updated with the correct events.

As far as I can see, the problem is the trigger/filter. I have also tried to disable and enable the actions, and restarted the sysloganalyzer.

Cisco Employee

Re: Syslog Automated Action

In addtion to being in the syslog.log, is there an entry in RME syslog analyzer for that device/message?

Resource Manager Essentials->Syslog Analysis->Standard Reports

select device you are getting messages from, and generate the report. Does the syslog message show up in that report?

Community Member

Re: Syslog Automated Action

Yes, everything seems normal except that the action is not triggered.

Tommy

Community Member

Re: Syslog Automated Action

Hi Tommy,

What OS do you use? I suppose it is Win2k. TAC has confirmed to me that there are problems with automatic actions on Win2k as the environment is not passed on properly. So some things run, others don't.

Cheers

Georg

Community Member

Re: Syslog Automated Action

Thanks!

Yes, I use w2k. Do you have more information about this? Do you have a example of something that does work?

Regards

Tommy

Community Member

Re: Syslog Automated Action

Here's 3 that work for me. Two for catalyst, one for websense not responding to pix.

SYS-*-3-PORT_COLLDIS-*

MGMT-*-5-PORT_ERRDISABLE-*

PIX-*-3-304006-*

159
Views
4
Helpful
11
Replies
CreatePlease to create content