Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

questions on Alarms in Sensor ?

hello

2 questions for sensor's gurus ..

where are located alarms in Sensor when you configure to save

them in the sensor ? in which directory ?

on which configuration file in the sensor do you set parameters to save

alarms in the sensor itself ?

can anybody already found this information (didnt in documentation)

thanks in advance for any help

JYP

1 REPLY
Cisco Employee

Re: questions on Alarms in Sensor ?

The current log is found in /usr/nr/var and can be viewed with the strings command. When the log reaches the max size (default 1MB) or timeout (6 hours) it is rolled into /usr/nr/var/new. Eventually these logs are rolled into the /usr/nr/var/dump directory and then purged so that the file system does not fill up.

Logging is on by default (the /usr/nr/etc/daemons file contains "nr.loggerd"). The /usr/nr/etc/destinations file will include a line that defines the local logging:

1 test.cisco loggerd 1 EVENTS,ERRORS,COMMANDS

This line will cause all EVENTS,ERRORS,COMMANDS of level 1 and greater to be logged. You can configure this with the IDM interface - select the Configuration Tab, Logging and the Event Logging.

You can view the logs by selecting the Monitoring tab and then Logs.

81
Views
0
Helpful
1
Replies
CreatePlease to create content