Enabling and Tracking Syslogs Using Syslog Analyzer and Collector

Transcription

1 CHAPTER 15 Enabling and Tracking Syslogs Using Syslog Analyzer and Collector The Syslog Analyzer application along with the syslog collector lets you centrally log and track syslog messages (error, exception, information, etc.) sent by devices in the network. The logged message data can be used to analyze network device performance. Syslog Analyzer application can also be customized to store and produce the information important to you. The Syslog Analyzer application, or the Syslog Analyzer, works together with the Common Syslog Collector (CSC) (see Overview: Common Syslog Collector). The Syslog Analyzer receives syslogs from the Common Syslog Collector, invokes automated actions that have been configured for RME, and stores the syslogs in the database. You can use the Syslog Analyzer to generate many useful reports on the syslogs stored in the database. You can also define templates for custom reports. Network devices can be configured to send Syslog messages directly to the Common Syslog Collector installed on the CiscoWorks Server, or a remote network host on which a Syslog Collector is installed, which is the Remote Syslog Collector (RSAC). The Common Syslog Collector is configured to filter and forward messages to the CiscoWorks Server. This section contains: Viewing Status and Subscribing to a Common Syslog Collector Using Syslog Analyzer Using Syslog Service on Windows Checking the Syslog Configuration File on UNIX Stopping and Restarting Syslog Analyzer Viewing Syslog Analyzer Status Configuring Devices to Send Syslogs Syslog Administrative Tasks Defining Custom Report Templates Defining Automated Actions Defining Message Filters Overview: Syslog Analyzer Reports Understanding Message Reports Using Device Center 15-1

2 Chapter 15 Creating a Custom Report: Example In addition, Syslog Analyzer application also notifies: Inventory application, when a network device sends a inventory change syslog messages like SYS-5-RELOAD, SNMP-5-COLDSTART etc. For a complete list of messages that trigger Inventory collection see Table Table 15-1 Messages that Trigger Inventory Collection Facility Sub-facility Severity Mnemonic Description * * * RESTART * RESTART * * * * OIR * 6 INSCARD * SYS * 5 ONLINE * SNMP * 5 COLDSTART * SYS * 5 RELOAD * CPU_REDUN * 6 BOOTED_AS_ACTIVE * CPU_REDUN * 5 SWITCHOVER * Nodemgr * 5 CE *REBOOT* Config collection application, when a network device sends configuration change messages like SYS-6-CFG_CHG, CPU_REDUN-6-RUNNING_CONFIG_CHG etc. For a complete list of messages that trigger a Configuration fetch see Table Table 15-2 Messages that Trigger a Configuration Fetch Operation Facility Subfacility Severity Mnemonic Description * * * RESTART * RESTART * * * * SYS * 5 ONLINE * * * * CONFIG_I * SYS * 5 RELOAD * CONFIG * * * * * * * CONFIG * OIR * 6 INSCARD * Nodemgr * 5 CE *REBOOT* CPU_REDUN * 6 BOOTED_AS_ACTIVE * CPU_REDUN * 5 SWITCHOVER * CPU_REDUN * 6 RUNNING_CONFIG_CHG * CPU_REDUN * 5 RCSF_SYNCED * CPU_REDUN * 6 STARTUP_CONFIG_CHG * 15-2

3 Chapter 15 (continued) CPU_REDUN * 5 STARTUP_CONFIG_SYNCED * SNMP * 5 COLDSTART * SYS * 6 CFG_CHG *telnet* SYS * 6 CFG_CHG *Console* * * * OIR * PIX * * SYS * 6 CFG_CHG *SNMP* SYS * 6 CFG_CHG *SSH* Devices send Syslog messages that contain a time stamp reflecting the local time zone of the device. Syslog reports are always displayed in server time zone. If a device time zone is an unsupported format, the server time zone is used. If a device is not configured to send time zone information with its messages, Syslog assumes that the device resides in the server time zone and uses that time zone in the message time stamp. For example, assume that a managed device in India (set to the local time zone) sends a Syslog message to an RME server in California. When this message is viewed on a client browser in New York, the message will reflect California time. Caution Any change that you make to the system time or time zone affects the Syslog processes and other RME processes. You will then have to restart the Daemon Manager for the proper functioning. Using the Syslog Analyzer application is easy. After, Configuring the network devices, Installing a Syslog Collector, Registering it with Syslog Analyzer, you can use Syslog Analyzer to do these tasks: View Syslog Collector status for message statistics (see Viewing Common Syslog Collector Status). Set the Purge policy, to specify the age of a message up to which it should be stored (see Setting the Purge Policy). You can also perform a forced purge (see Performing a Forced Purge). Set the backup policy (see Setting the Backup Policy). Define custom message report templates (see Creating a Custom Report Template). Generate standard and custom reports, including 24-hour reports (see Understanding Message Reports). Define message filters to exclude or include certain messages from Syslog Analyzer (see Defining Message Filters). Define automated actions with which you can add and edit instructions ( , URL or script) to be executed automatically whenever a specific message type is reported (see Defining Automated Actions). 15-3

4 Overview: Common Syslog Collector Chapter 15 You can generate the following reports and summaries using the Report Generator (RME > Reports > Report Generator): 24-Hour Report Generate a report to show data for the past 24 hours. See Generating a Standard Report. Syslog Custom Summary Report Shows a summary of all custom reports. This is created and added by the system administrator. See Generating a Syslog Custom Summary Report. Severity Level Summary Report Summarizes messages in order of severity level (emergencies, alerts, critical, etc.). You can select a group of devices and a range of dates for your report. From this summary, you can display detailed reports of each type of message. See Generating a Severity Level Summary Report. Standard Report Shows logged messages for a group of devices within a selected range of dates. See Generating a Standard Report. Unexpected Device Report Provides syslog information from all the devices on your network, that have not been added to RME, if they have been configured to send messages to the server. See Generating an Unexpected Device Report. You can also define custom reports templates using the Custom Reports Templates option (RME > Reports > Custom Reports Templates). The reports templates that you create are displayed in the Report Generator. Note You can select the log level settings for the Syslog application using the feature Application Log Level Settings (Resource Manager Essentials > Admin > System Preferences > Loglevel Settings). For the new features in this release, see What's New in this Release. Overview: Common Syslog Collector Common Syslog Collector (CSC) is a service to receive, filter and forward syslogs to one or more Syslog Servers, thus reducing traffic on the network as well as processing load on the server. The Common Syslog Collector can be installed on the CiscoWorks Server, or on a remote UNIX or Windows machine, to process Syslog messages. You can uninstall the Syslog Collector later if you no longer want to run it on a remote UNIX or Windows server. Common Syslog Collector is a service that runs independently, listens for syslogs and forwards them to the registered applications after necessary filtering. This way, the parsing/filtering is taken away from the applications and each device sends only one copy of the processed, valid syslogs to the Common Syslog Collector. Although CSC runs independently, it can run either remotely or locally on the machine where an application is running. The RME server and the Syslog Collector exchange updates such as status, and filters. You can configure the service to read syslogs from a specified file. This can be provided in a properties file located at: On Solaris: NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/ Collector.properties 15-4

5 Chapter 15 Viewing Status and Subscribing to a Common Syslog Collector On Windows: NMSROOT%\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\ Collector.properties See the Installing and Getting Started With CiscoWorks LAN Management Solution, for the complete details. In a scenario where the devices and the CSC may run in two different time zones, the syslogs will be marked with timestamp of the CSC if they do not have a timestamp when they are received, or if the format is not correct. The device considers day-light-saving settings appropriately while putting the timestamps. CSC supports all the time zones that Common Services supports, and alternatively you can provide the time zone information. See the Installing and Getting Started With CiscoWorks LAN Management Solution, for the complete details. After the Syslog Analyzer has been registered with the Collector, it: Receives the filters it needs from the RME server to filter Syslog messages. Sends status to the Syslog Analyzer process about the collected Syslog messages upon request from the Analyzer, including the number of messages read, number of messages filtered, and number of messages with bad syntax. It also forwards unfiltered messages to the Syslog Analyzer process. If the Syslog Analyzer does not send any filters, then the Collector sends all the syslogs to the Analyzer without filtering. If you restart the RME server, Syslog Collector will lose communication to the RME server. Based on the current filters, it continues to filter the syslogs and stores them in a local file: NMSROOT\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\server name_port\downtimesyslogs.log The Syslog Analyzer will automatically restore the connection after RME server restart. For the complete instructions on installing the Common Syslog Collector, see the Installing and Getting Started With CiscoWorks LAN Management Solution. Viewing Status and Subscribing to a Common Syslog Collector Using the Syslog Collector Status dialog box you can: View the status of your Common Syslog Collector (see Viewing Common Syslog Collector Status) Subscribe/Unsubscribe a Common Syslog Collector (see Subscribing to a Common Syslog Collector) Test Syslog Collector Subscription (see Testing Syslog Collector Subscription) Understanding the Syslog Collector Properties File Note View the Permission Report (Common Services > Server > Reports) to check if you have the required privileges to perform this task. 15-5

6 Viewing Status and Subscribing to a Common Syslog Collector Chapter 15 Viewing Common Syslog Collector Status To view the status of the Common Syslog Collector to which the Syslog Analyzer is subscribed to, follow this procedure: Select Resource Manager Essentials > Tools > Syslog > Syslog Collector Status. The Collector Status dialog box appears, with this information: Column Name Forwarded Invalid Filtered Dropped Received Up Time Update Time Test Collector Subscription Subscribe Unsubscribe Description Hostname or the IP address of the host on which the Collector is installed. Number of forwarded Syslog messages Number of invalid Syslog messages. Number of filtered messages. Filters are defined with the option Message Filters option (see Defining Message Filters.) Number of Syslog messages dropped. Number of Syslog messages received. Time duration for which the Syslog Collector has been up. Date and time of the last update. Time and time zone are those of the CiscoWorks Server. Click to test a Syslog collector that s already subscribed or that s going to be subscribed. Click to subscribe a Syslog collector. Select the Syslog collector and click Unsubscribe to unsubscribe the Syslog collector. If you want to refresh the information in this dialog box, click Update. If you have restarted the RME daemon manager, the Syslog Collector Status processes (under Resource Manager Essentials > Tools > Syslog) may take 6-10 minutes to come up, after the Syslog Analyze processes come up. In this interval you may see the following message: Collector Status is currently not available. Check if the SyslogAnalyzer process is running normally. Wait for the Syslog Collector status process to come up and try again. To subscribe to a Common Syslog Collector using the Subscribe button, see Subscribing to a Common Syslog Collector. Subscribing to a Common Syslog Collector Before you subscribe to a Common Syslog Collector, ensure these pre-requisites are met: Check whether: 1. The Self-signed Certificates are valid. For example, check for the expiry date of the certificates on both the servers. 2. The Self-signed Certificates from this server are copied to the Syslog Collector server and vice-versa. 15-6

7 Chapter 15 Viewing Status and Subscribing to a Common Syslog Collector To do this, go to Common Service Administration > Server Configuration > Security. Use the Peer certificate dialog box. See the User Guide for Common Services for more details. 3. The SyslogCollector process on Syslog Collector server and SyslogAnalyzer process on this server, are restarted after. 4. Both hosts are reachable by host name. To subscribe to a Common Syslog Collector: Step 4 Step 5 Select Resource Manager Essentials > Tools > Syslog. The Collector Status dialog box appears. For the information in the columns in the dialog box, see Viewing Common Syslog Collector Status: Click Subscribe. The following message appears: Check if: Self-signed Certificates from this server are copied to the Syslog Collector server and vice-versa. You can perform this operation from Common Service Administration > Server Configuration > Security > Peer certificate screen. 2. Syslog Collector process on SyslogCollector server and SyslogAnalyzer process on this server is restarted after step Both hosts are reachable by host name. 4. Certificates are valid. The Subscribe Collector dialog box appears. Click OK. Enter the address of the Common Syslog Collector to which you want to subscribe to. Click OK. The Syslog Analyzer server is subscribed to the specified Common Syslog Collector. If you are already subscribed to a Syslog collector, and you want to unsubscribe, select the collector and click the Unsubscribe button. If you want to test the Syslog collector subscription, select the collector and click Test Collector Subscription. For more information see Testing Syslog Collector Subscription. Testing Syslog Collector Subscription You can test the status of the Syslog Collector that you have already subscribed or that you are going to subscribe using the Test Collector Subscription button. To test a Syslog collector: Select Resource Manager Essentials > Tools > Syslog. The Collector Status dialog box appears. For the information on the dialog box, see Viewing Common Syslog Collector Status. Either: Select a Syslog collector and click Test Collector Subscription. 15-7

8 Viewing Status and Subscribing to a Common Syslog Collector Chapter 15 Test Collector Subscription pop-up window appears with the Syslog collector address. Or Click Test Collector Subscription. Enter the Syslog collector in the Test Collector Subscription pop-up window. Step 4 Click OK. The Test Collector Subscription Status pop-up window appears, displaying the following status of the Syslog collector: SSL certificate status Status of the SSL Certificates. For example, SSL certifactes are valid and are properly imported. For more information see Syslog Collector Subscription Messages. Collector status Status of the Syslog collector. For example, Collector is up and reachable. For more information see Syslog Collector Subscription Messages. Syslog Collector Subscription Messages The following table provides the Syslog collector subscription status messages shown when you test the subscription of a Syslog Collector: Subscription Status Problem/Info Message SSL Certification Collector When there is an issue with SSL Certificate When the SSL certificates are valid When the hostname is not DNS resolvable SSL certificate issue occurred, check if: 1. The Self-signed Certificates are valid. For example, Check the certificate expiry date on the servers. 2. The Self-signed Certificates of this server are copied to the Syslog Collector server and vice-versa. To do this, go to Common Services > Server > Security > Multi-Server Trust Management > Peer Server Certificate Setup and add the certificate. See the User Guide for CiscoWorks Common Services for more details. 3. The SyslogCollector process on Syslog Collector server and the SyslogAnalyzer process in the current working server are restarted after Step Both hosts are reachable by hostname. SSL certificates are valid and properly imported. Unknown host address. Check if the host is DNS resolvable. 15-8

9 Chapter 15 Viewing Status and Subscribing to a Common Syslog Collector Subscription Status Problem/Info Message If the SyslogCollector process is down If the Syslog Collector is down If the Syslog Collector is reachable SyslogCollector process is down. Check if the SyslogCollector process is running on the port <<port number>>. Cannot check SSL connectivity because the Syslog Collector is down. Syslog Collector <<collector name> is up and reachable. Understanding the Syslog Collector Properties File After installing the Syslog Collector on a remote system, you need to check the Syslog Collector Properties file to ensure that the Collector is configured properly. The Syslog Collector Properties file is available at this location: On Solaris: $NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/Collector.pr operties On Windows: %NMSROOT%\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector. properties The following table describes the Syslog Collector Properties file: Timezone-Related Properties TIMEZONE COUNTRY_CODE Description The timezone of the system where the Syslog Collector is running. Enter the correct abbreviation for the timezone. For example, the time zone for India is IST. For the correct Timezone abbreviation, see the Timezone file in the following location: On Solaris, /opt/cscopx/mdc/tomcat/webapps/rme/web-inf/classes/com/cisco/n m/rmeng/fcss/data/timezone.lst On Windows, %NMSROOT%\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\ nm\rmeng\fcss\data\timezone.lst See Timezone List Used By Syslog Collector. Country code for the Syslog Collector. We recommend that you set the country code variable with the appropriate country code, to make sure that the Syslog timestamp conversion works correctly. For example, if you are in Singapore, you must set the country code variable as COUNTRY=SGP. 15-9

10 Viewing Status and Subscribing to a Common Syslog Collector Chapter 15 Timezone-Related Properties TIMEZONE_FILE General Properties SYSLOG_FILES DEBUG_CATEGORY_NAME DEBUG_FILE DEBUG_LEVEL Description The path of the Timezone file. This file contains the offsets for the time zones. After installing the Syslog Collector, ensure that the offset specified in this file is as expected. If it is not present or is incorrect, you can add the Timezone offset as per the convention. The default path is: On Solaris, opt/cscopx/mdc/tomcat/webapps/rme/web-inf/classes/com/ cisco/nm/rmeng/fcss/data/timezone.lst On Windows, %NMSROOT%\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\ nm\rmeng\fcss\data\timezone.lst Filename and location of the file from which syslog messages are read. The default location is: On Solaris: /var/log/syslog_info On Windows: %NMSROOT%\log\syslog.log Name Syslog Collector uses for printed ERROR or DEBUG messages. The default category name is SyslogCollector. We recommend that you do not change the default value. Filename and location of the Syslog Collector log file containing debug information: The default location is: On Solaris, /var/adm/cscopx/log/collectordebug.log On Windows, %NMSROOT%\log\CollectorDebug.log Debug levels in which you run the Syslog Collector. We recommend that you retain the default INFO, which reports informational messages. Setting it to any other value might result in a large number of debug messages being reported. If you change the debug level, you must restart the Syslog Collector. The values for the Debug levels are: Warning Debug Error Info 15-10

11 Chapter 15 Viewing Status and Subscribing to a Common Syslog Collector Timezone-Related Properties Description DEBUG_MAX_FILE_SIZE Maximum size of the log file containing the debug information. The default is set to 5 MB. If the file size exceeds the limit that you have set, Syslog Collector writes to another file, based on the number of backup files that you have specified for the DEBUG_MAX_BACKUPS property. For example, if you have specified the number of backups as 2, besides the current log file, there will be two backup files, each 5MB in size. When the current file exceeds the 5 MB limit, Syslog Collector overwrites the oldest of the two backup files. DEBUG_MAX_BACKUPS The number of backup files that you require. The size of these will be the value that you have specified for the DEBUG_MAX_FILE_SIZE property. Miscellaneous Properties READ_INTERVAL_IN_SECS Interval at which the Collector polls the syslog file. The default is set to 1 second. QUEUE_CAPACITY Size of the internal buffer, for queuing syslog messages. The default is set to PARSER_FILE File that contains the list of parsers used while parsing syslog messages. The default path of the parser file: On Solaris, opt/cscopx/mdc/tomcat/webapps/rme/web-inf/classes/com/ cisco/nm/rmeng/fcss/data/formatparsers.lst On Windows, %NMSROOT%\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\ nm\rmeng\fcss\data\formatparsers.lst SUBSCRIPTION_DATA_FILE Syslog Collector data file that contains the information about the Syslog Analyzers that are subscribed to the Collector. The default path of the data file: On Solaris, opt/cscopx/mdc/tomcat/webapps/rme/web-inf/classes/com/ cisco/nm/rmeng/csc/data/subscribers.dat On Windows, %NMSROOT%\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\ nm\rmeng\csc\data\subscribers.dat FILTER_THREADS Number of threads that operate at a time for filtering syslog messages. The default is set to 1. COLLECTOR_PORT Default port of the Syslog Collector. The default is set to The port where the collector listens for registration requests from Syslog Analyzers

12 Viewing Status and Subscribing to a Common Syslog Collector Chapter 15 Timezone List Used By Syslog Collector The timezone of the system where the Syslog Collector is running. In the Syslog Collector Properties file, you must enter the correct abbreviation for the timezone. See Understanding the Syslog Collector Properties File. For the correct Timezone abbreviation, see the Timezone file in the following location: $NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/fcss/data/TimeZone.l st Each entry in the TimeZone.lst file represents a timezone abbreviation, and its offset from GMT. Each offset here is 10 multiplied by the actual offset. For example, the actual offset for IST is 5.5 hours, and the corresponding entry here is 55. You must use the same method while modifying it. The following is the timezone list used by Syslog Collector: Time Zone List Used by Syslog Collector ACT=95 ADT=30 AET=100 AEST=100 AGT=-30 AHST=-100 ART=20 AST=-90 AT=-20 BET=-30 BST=10 BT=30 CAT=10 CCT=80 CDT=-50 CEST=20 CET=10 CNT=-35 CST=-60 CTT=80 EADT=-110 EAST=100 EAT=30 ECT=10 EDT=-40 EET=20 EST=-50 FST=-20 FWT=10 GMT=0 GST=100 HDT=90 HST=-100 IDLE=120 IDLW=-120 IET=-50 IST=55 JST=90 MDT=-60 MEST=-20 MESZ=-20 MET=10 MEWT=10 MIT=-110 MST=-70 MYT=80 NET=40 NST=120 NT=-110 NZDT=130 NZST=120 NZT=120 PDT=-70 PLT=50 PNT=-70 PRT=-40 PST=-80 SST=110 SWT=10 UTC=0 VST=70 WADT=-80 WAST=70 WAT=-10 YDT=-80 YST=-90 ZP4=40 ZP5=50 ZP6=

13 Chapter 15 Using Syslog Analyzer Using Syslog Analyzer The following is the workflow for Syslog Analyzer: Step 4 Configure devices (see Configuring Devices to Send Syslogs). Configure the Common Syslog Collector which is installed during the RME installation, or install another Remote Syslog Collector on another machine (see the Installing and Getting Started With CiscoWorks LAN Management Solution). Perform various tasks such as defining and managing filters, automated actions, setting back-up policy, setting the purge policy, performing a forced purge, defining custom reports templates, specifying the path for the Syslog message file, etc. See: Setting the Backup Policy Setting the Purge Policy Performing a Forced Purge Defining Custom Report Templates Defining Automated Actions Defining Message Filters Generate various reports such as Custom Summary report, Severity Level Summary report, Standard Report, Unexpected Device report and Workflow report. See: Overview: Syslog Analyzer Reports Generating a Syslog Custom Summary Report Generating a Severity Level Summary Report Generating a Standard Report Generating an Unexpected Device Report Using Syslog Service on Windows System message logging is not part of the Windows operating system. Therefore, the CiscoWorks Server provides logging service to Windows users. The logging service saves each system message to NMSROOT\log\syslog.log (where NMSROOT is the RME installation directory). Syslog Analyzer reads and processes the messages in this file, and writes them to the RME database. The Syslog processes use the database information to generate Syslog reports. When the syslog.log file gets too big, you can stop the Syslog Analyzer (Start > Settings > Control Panel > Services) and delete the log file

14 Checking the Syslog Configuration File on UNIX Chapter 15 Note View the Permission Report (Common Services > Server > Reports) to check if you have the required privileges to perform this task. Step 4 Step 5 Select Common Services > Server > Admin > Processes. The Process Management dialog box appears. Select SyslogCollector and click Stop. Open the Windows Control Panel and select Administrative tools > Services. Select CWCS syslog service, and click Stop. Delete the NMSROOT\log\syslog.log file. To restart the syslog service in the Control Panel, click Start next to the CWCS syslog service. To restart the SyslogAnalyzer process in RME, select Common Services > Server > Admin > Processes and click Start. Checking the Syslog Configuration File on UNIX Check the path and permissions of the file pointed to by local7.info in the syslog configuration file /etc/syslog.conf on the RME server. Note The first occurrence of local7 in the syslog.conf file, must contain the path for the Syslog message source. Make sure that the facility.level definition is set to local7.info, and that the following line is present (there must be a tab between local7.info and the path/filename): local7. info path/filename Make sure that the syslog process (syslogd) can both read and write to the file. If you modify the /etc/syslog.conf file, you must restart the syslog process (syslogd). Enter the following command to stop and restart syslogd: /etc/init.d/syslog stop /etc/init.d/syslog start If the start and stop command do not work, enter: kill -HUP 'cat /etc/syslog.pid' Make sure the path for Syslog message file in the CiscoWorks Server is the same as the filename you specified in the syslog.conf file

15 Chapter 15 Stopping and Restarting Syslog Analyzer Stopping and Restarting Syslog Analyzer To stop Syslog Analyzer: Select Common Services > Server > Admin > Processes. The Process Management dialog box appears. Select SyslogAnalyzer. Click Stop. To restart Syslog Analyzer: Select Common Services > Server > Admin > Processes. The Process Management dialog box appears. Select SyslogAnalyzer. Click Start. Viewing Syslog Analyzer Status You can check Syslog status using this option. Note View the Permission Report (Common Services > Server > Reports) to check if you have the required privileges to perform this task. Click Common Services > Server > Admin > Processes. The Process Management dialog box appears. Click SyslogAnalyzer (hyperlink) to view process details. The Process Details window appears. Field Process Path Flags Startup Dependencies Data Process name Fully qualified path name for the Java Runtime Environment (JRE) Java package name and class file of the Syslog Analyzer program When the process was started Prerequisite processes 15-15

16 Configuring Devices to Send Syslogs Chapter 15 Configuring Devices to Send Syslogs Syslog Analyzer lets you centrally log and track system error messages, exceptions, and other information (such as device configuration changes) that you can use to analyze device and network performance. Configure devices to forward messages to the RME server or to a system on which you have installed the Common Syslog Collector. For details about the Syslog Collector, see the Installing and Getting Started with LAN Management Solution 3.0. For more information about setting up devices for message logging, see the Cisco IOS Software Documentation on Cisco.com. On UNIX systems, make sure that the Syslog facility for the device is set to local7. Messages from devices are continuously added to the file pointed to by the logging facility local7.info in the /etc/syslog.conf (syslog configuration) file. The first occurrence of local7 in the syslog.conf file, must contain the path for the Syslog message source. Note View the Permission Report (Common Services > Server > Reports) to check if you have the required privileges to perform this task. You can configure the devices for sending Syslog messages to RME server in the following ways: Configuring the Device Using Telnet IOS Devices Catalyst Devices Content Service Switches Devices Content Engine Devices NAM Devices PIX Devices Configuring the Device Using NetConfig Syslog Task Configuring the Device Using Telnet This section details how to configure devices using Telnet. IOS Devices To configure IOS devices using Telnet: Connect to the device using Telnet and log in. The prompt changes to host>. Enter enable and the enable password. The prompt changes to host#

17 Chapter 15 Configuring Devices to Send Syslogs Enter configure terminal. You are now in configuration mode, and the prompt changes to host(config)#. To make sure logging is enabled, enter logging on. To specify the RME server to receive the router Syslog messages, enter logging IP address, where IP address is the server IP address. Step 4 To limit the types of messages that can be logged to the RME server, enter logging trap informational to set the appropriate logging trap level by, where informational signifies severity level 6. This means all messages from level 0-5 (from emergencies to notifications) will be logged to the RME server. Verify that the syslog filter settings are correct and that syslog is running. Catalyst Devices To configure Catalyst devices using Telnet: Connect to the device using Telnet and log in. The prompt changes to host. Enter enable and the enable password. The prompt changes to host#. To make sure logging is enabled, enter set logging server enable. To specify the RME server that is to receive the Catalyst devices Syslog messages, enter set logging server IP address, where IP address is the server IP address. Step 4 To limit the types of messages that can be logged to the RME server, enter set logging level all 6 default. This means that all messages from level 0-5 (from emergencies to notifications) will be logged to the RME server. See the appropriate Catalyst reference manual for more information. Verify that the syslog filter settings (see Defining Message Filters) are correct and that syslog is running. Content Service Switches Devices To configure Content Service Switches (CSS) devices using Telnet: Connect to the device using Telnet and enter into the Global Configuration mode. Run the following commands: logging commands enable logging host CiscoWorks IP address logging facility local

18 Configuring Devices to Send Syslogs Chapter 15 Content Engine Devices To configure Content Engine (CE) devices using Telnet: Connect to the device using Telnet and enter into the Global Configuration mode. Run the following commands: logging host CiscoWorks IP address logging facility local7 NAM Devices To configure NAM devices using Telnet: Connect to the device using Telnet and enter into the Global Configuration mode. Run the following commands: remote-host CiscoWorks IP address logging facility local7 PIX Devices To configure PIX devices using Telnet: Connect to the device using Telnet and enter into the Global Configuration mode. Run the following commands: logging host CiscoWorks IP address [in_if_name] CiscoWorks IP address [protocol /port] [format emblem], where: in_if_name is the interface on which the syslog server resides. CiscoWorks IP address is the address of the CiscoWorks server. protocol is the protocol over which the syslog message is sent; either tcp or udp. PIX Firewall only sends TCP syslog messages to the PIX Firewall Syslog Server. You can only view the port and protocol values you previously entered by using the write terminal command and finding the command in the listing the TCP protocol is listed as 6 and the UDP protocol is listed as 17. port is the port from which the PIX Firewall sends either UDP or TCP syslog messages. This must be same port at which the syslog server listens. For the UDP port, the default is 514 and the allowable range for changing the value is 1025 through

19 Chapter 15 Configuring Devices to Send Syslogs For the TCP port, the default is 1470, and the allowable range is 1025 through TCP ports only work with the PIX Firewall Syslog Server. format emblem is the option that enables EMBLEM format logging on a per-syslog-server basis. EMBLEM format logging is available for UDP syslog messages only and is disabled by default. Configuring the Device Using NetConfig Syslog Task This section details how to configure devices using the NetConfig Syslog task. Use the job definition wizard in NetConfig to create and schedule a NetConfig job. For more details see the Making and Deploying Configuration Changes Using NetConfig topics. See the following procedure to launch the NetConfig application and use the NetConfig Syslog task in a job: Select Resource Manager Essentials > Config Mgmt > NetConfig. The NetConfig Job Browser appears. Ensure that you have set the transport protocol order and password policy for your job using Resource Manager Essentials > Admin > Config Mgmt > Archive Mgmt. See the topics Configuring Transport Protocols and Configuring Default Job Policies in the section, Archiving Configurations and Managing Them Using Archive Management. For the fields in the NetConfig Job Browser, see Starting a New NetConfig Job in the section Making and Deploying Configuration Changes Using NetConfig. Click Create. The Devices and Tasks dialog box appears, with these panes. See Table 15-3: Table 15-3 Pane Device Selector Task Selector Panes in the Devices and Tasks Dialog Box Description Allows you to select the devices on which the NetConfig job has to run. Make sure that for the devices on which the job will run, the configurations are archived in the Configuration Archive. NetConfig will not configure devices whose configurations are not archived. (See Archiving Configurations and Managing Them Using Archive Managementon how to update the configuration archive.) Allows you to select the system-defined tasks or user-defined tasks that you want to run on the selected devices. For descriptions of system-defined tasks and the device categories they support, seecreating and Editing User-defined Tasks in the section Making and Deploying Configuration Changes Using NetConfig. Select the devices from the Device Selector pane. For details about the Device Selector, see the topic Using RME Device Selector in the section Adding and Troubleshooting Devices Using Device Management. Step 4 Select the required task from the All tab, Using the Task Selector. Your selection appears in the Selection pane. You can select one or more task at a time

20 Configuring Devices to Send Syslogs Chapter 15 Step 5 Click Next. The Add Tasks dialog box appears with these panes: (See Table 15-4). The buttons in the Added Instances Pane are explained in Table 15-5: Table 15-4 Panes in the Add Tasks Dialog Box Pane Applicable Tasks Added Instances Description Allows you to add a task. The task that you selected using the Task Selector, appears here. From your selection, only the tasks that are applicable to at least one device that you have selected, appear here. If the task that you have selected does not apply to the categories of any of the devices that you have selected, it will not be displayed in the Applicable Tasks pane. Select a task and click Add to create an instance for the task (see Step 6). Allows you to edit the task instance you have added, view its CLI, or delete it. Select the instance of the task, and click the required button. Table 15-5 Button Edit View CLI Delete Tasks Performed by Buttons in the Added Instances Pane Description Task pop-up opens with previously assigned values. You can edit these values and click Save. Device Commands pop-up opens with the list of applicable devices and their corresponding CLI commands. Devices in your selection for which the commands are not applicable, are also displayed as Non-Applicable Devices. Click Close. You can edit an instance of a configuration task (and its configuration commands) at any time before the job is scheduled. Deletes the selected task instance. You can delete an instance of a configuration task (and its configuration commands) at any time before the job is scheduled. Step 6 Select the Syslog configuration task from the Applicable Tasks pane and click Add. The Syslog Configuration Task (system-defined or user-defined) pop-up appears for the selected task (seecreating and Editing User-defined Tasks in the section Making and Deploying Configuration Changes Using NetConfig). This is a dynamic user interface. The Syslog Configuration task dialog box displays parameters based on your device selection in the Device Selector. For example, if you have selected Content Engine devices, you will be able to specify Content Engine parameters in this dialog box. If not, this section will not be available to you

21 Chapter 15 Syslog Administrative Tasks Step 7 Step 8 Step Set the parameters in the task dialog box and click Save. To reset the values that you have selected click Reset. Click Cancel to return to the previous dialog box, without saving your changes. You will see the instance of the task in the Added Tasks pane of the Add Tasks dialog box. The instance appears in this format: Taskname_n, where Taskname is the name of the task you have added, and n is the number of the instance. For example, the first instance of a Banner task is Banner_1. You can add as many instances as required, for a task. Click Next. The Job Schedule and Options dialog box appears. Set the schedule for the job, in the Scheduling pane. Set the job options, in the Job Options pane. To view the device order, click Device Order. The Set Device Order pop-up appears. You can reset the order in which the job should be executed on the devices using the up and down arrows. When you are done, click Done. The pop-up closes. Click Next. The Job Work Order dialog box appears with the general information about the job, the job policies, the Job Approval details (if you have enabled job approval), the device details, the task, and the CLI commands that will be executed on the selected devices as part of this job. Click Finish after you review the details of your job in the Job Work Order dialog box. A job confirmation message appears along with the Job ID. The newly created job appears in the NetConfig Job Browser. For the complete procedure on how to schedule the NetConfig job see Starting a New NetConfig Job in the section Making and Deploying Configuration Changes Using NetConfig. Also see Syslog Task in the section Making and Deploying Configuration Changes Using NetConfig. Syslog Administrative Tasks You can perform the following Administrative tasks: Back up Syslog messages (see Setting the Backup Policy). Purge Syslog messages (see Setting the Purge Policy). Perform a Forced Purge (see Performing a Forced Purge). Note View the Permission Report (Common Services > Server > Reports) to check if you have the required privileges to perform these tasks

22 Syslog Administrative Tasks Chapter 15 Setting the Backup Policy The Backup Configuration feature allows you to save the Syslog messages to a flat file. The syslog data that is trimmed from the database will be moved to the flat file. In Solaris, the backup file is created with -rw-r----- casuser casusers irrespective of the permissions given to the directory for backup on purge. In Windows, the backup file inherits the permission and ownership of the directory it is created in, which is the directory selected as the backup location (on purge). View the Permission Report (Common Services > Server > Reports) to check if you have the required privileges to perform this task. To set up the backup policy: Step 4 Step 5 Step 6 Select Resource Manager Essentials > Admin > Syslog > Set Backup Policy. The Backup Policy dialog box appears. By default, the backup policy is set to disabled. Select Enable to enable the backup process for Syslog messages, after configuring backup. Click Browse to select the backup file location. The Server Side File Browser dialog box appears. In the Server Side File Browser dialog box: a. Specify the external directory. The external directory must be under the syslog directory, or a sub-directory within the syslog directory. For example, $NMSROOT/files/rme/syslog/sysbackup. The external directory cannot be outside the syslog directory. If you attempt to navigate outside the syslog directory, an error message appears. b. Select Directory Content, c. Click OK. Enter the maximum size that you want to set for the backup file. By default this is set to 100 MB. Enter the ID of the user who should receive a notification, if the backup fails. You can enter multiple addresses separated with commas. This is a mandatory field. Configure the SMTP server to send s in the View/Edit System Preferences dialog box (Common Services > Server > Admin > System Preferences). We recommend that you configure the CiscoWorks ID in the View / Edit System Preferences dialog box (Common Services > Server > Admin > System Preferences). When the job completes, an is sent with the CiscoWorks ID as the sender's address.) If you also want a notification to be sent when the backup is a success, select Also Notify on Success. Either click Save to save the backup configuration details that you have specified or click Reset to clear the values that you specified and reset to the previously saved values in the dialog box. If you have clicked Save, the backup will continue to save the data even after the data has exceeded the specified size of the backup file. However, the system will send an asking you to cleanup the backup file

23 Chapter 15 Syslog Administrative Tasks Setting the Purge Policy You can specify a default policy for the periodic purging of Syslog messages. If you access a table either through immediate reports, report jobs or by any other means, the database locks the table and therefore the table will not be successfully purged. However, during the successive purge operations such a table will be purged. A purge job is enabled by default, and is scheduled to run at 1:00 AM daily. To specify your default purge policy: Select Resource Manager Essentials > Admin > Syslog > Set Purge Policy. The Purge Policy dialog box appears. Specify the number of days in the Purge records older than field. Only the records older than the number of days that you specify here, will be purged. The default value is 7 days. This is a mandatory field. Caution Step 4 Step 5 Step 6 You might delete data by changing these values. If you change the number of days to values lower than the current values, messages over the new limits will be deleted. If the data of a particular day is being accessed either through Immediate reports, Report jobs, or by any other means, it will not be purged. However, during the successive purge operations this data will be purged. Specify the periodicity of the purge in the Run Type field. This can be monthly, daily, or weekly. Select the start date using the calendar icon, to populate the date field in the dd-mmm-yyyy format (For example, 02-Dec-2004). This is a mandatory field. Enter the start time in the At field, in the hh:mm:ss format (23:00:00). This is a mandatory field. The Job Description field has a default description Syslog Records - default purge job. Enter the ID of the user who should be notified when the scheduled purge is complete. You can enter more than one ID separated by commas. This is a mandatory field. Configure the SMTP server to send s in the View / Edit System Preferences dialog box (Common Services > Server > Admin > System Preferences). We recommend that you configure the CiscoWorks ID in the View / Edit System Preferences dialog box (Common Services > Server > Admin > System Preferences). When the job completes, an is sent with the CiscoWorks ID as the sender's address Either click Save to save the purge policy that you have specified or click Reset. to clear the values that you specified and reset the defaults in the dialog box. You can view the scheduled purge job in the Common Services JRM Job Browse (Common Services > Server > Admin > Job Browser)

24 Syslog Administrative Tasks Chapter 15 Performing a Forced Purge You can perform a forced purge of Syslog messages, as required. If you access a table either through Immediate reports, Report jobs or by any other means, the database locks the table and therefore the table will not be successfully purged. However, during the successive purge operations such a table will be purged. To perform a Forced Purge: Select Resource Manager Essentials > Admin > Syslog > Force Purge. The Force Purge dialog box appears. Enter the information required to perform a Forced Purge: Field Purge records older than Scheduling Run Type Description Enter the number of days. Only the records older than the number of days that you specify here, will be purged. This is a mandatory field. If the data of a particular day is being accessed either through Immediate reports, Report jobs, or by any other means, it will not be purged. However, during the successive purge operations this data will be purged. Specify whether the purge is to be Immediate or Once. If you select Immediate, all the other options will be disabled for you. If you select Once, you can specify the start date and time and also provide the job description (mandatory) and the ID for the notification after the scheduled purge is complete. Configure the SMTP server to send s in the View / Edit System Preferences dialog box (Common Services > Server > Admin > System Preferences). We recommend that you configure the CiscoWorks ID in the View / Edit System Preferences dialog box (Common Services > Server > Admin > System Preferences). When the job completes, an is sent with the CiscoWorks ID as the sender's address. Date Select the start date using the calendar icon, to populate the Date field in the dd-mmm-yyyy format, for example, 02-Dec This is a mandatory field. The Date field is enabled only if you have selected Once as the Run Type. at Enter the start time, in the hh:mm:ss format (23:00:00). The at field is enabled only if you have selected Once as the Run Type

25 Chapter 15 Defining Custom Report Templates Field Job Info Job Description Description Enter a description for the forced purge job. The Job Description field is enabled only if you have selected Once as the Run Type. This is a mandatory field. Accepts alphanumeric values. Enter the ID of the user who should be notified when the Forced Purge is complete. You can enter more than one ID separated by commas. The field is enabled only if you have selected Once as the Run Type. Configure the SMTP server to send s in the View/ Edit System Preferences dialog box (Common Services > Server > Admin > System Preferences). We recommend that you configure the CiscoWorks ID in the View/Edit System Preferences dialog box (Common Services > Server > Admin > System Preferences). When the job completes, an is sent with the CiscoWorks ID as the sender's address Click Submit for the Forced Purge to become effective. To clear the values that you specified and reset the defaults in the dialog box, click Reset. You can view the scheduled Force Purge job in the Common Services JRM Job Browse (Common Services > Server > Admin > Job Browser). Defining Custom Report Templates This section contains: Creating a Custom Report Template Editing a Custom Template Deleting a Custom Template Running a Custom Report When you create a custom report template, you select the syslog message types you want reported. The Custom Templates option lets you create a custom template, and edit or delete existing custom templates. When you select Resource Manager Essentials > Reports > Custom Templates, a list of all Custom Templates is displayed in the dialog box on the Custom Templates page. The columns in the Custom Templates dialog box are: Column Template Name Report Type Owner Last Modified Time Description Name of the template. Syslog report, or inventory report. User who created the template. Date (yyyy-mm-dd) and the time (hh:mm:ss)

26 Defining Custom Report Templates Chapter 15 Using the custom templates dialog box, you can do the following tasks: Note View the Permission Report (Common Services > Server > Reports) to check if you have the required privileges to perform this task. Task Create a custom template (see Creating a Custom Report Template). Editing a custom template (see Editing a Custom Template). Delete a custom template (see Deleting a Custom Template). Button Create Edit Delete Creating a Custom Report Template To create a custom report template: Step 4 Select Resource Manager Essentials > Reports > Custom Report Templates. The custom templates dialog box appears. Click Create. The Application Selection dialog box appears. Select Syslog. Click Next. The Syslog custom report template dialog box appears. The messages that have previously been defined are displayed here. The columns in the Syslog custom reports templates dialog box are: Column Facility Sub-Facility Severity Description Facility is a hardware device, a protocol, or a module of the system software; for example, SYS. See the Cisco IOS reference manual System Error Messages for a predefined list of facility codes. Sub-Facility is the subfacility in the device that generated the Syslog message. In most cases, this is blank. An example of an entry in this field is CCM_CDR_INSERT-GENERIC-0-OutOfMemory. The severity level for the messages. The following are the severity codes: 0 Emergencies 1 Alerts 2 Critical 3 Errors 4 Warnings 5 Notifications 6 Informational 15-26