Syslog Message Filtering: Example 2
• How to only log the error messages related to
spanning tree?
Switch> (enable) set logging session enable
Switch> (enable) set logging server 10.10.10.10
Switch> (enable) set logging server severity 0
Switch> (enable) set logging level spantree 0
Switch> (enable) set logging server facility local5
Switch> (enable) set logging console enable
• On the Syslog server (UNIX), the corresponding line
in Syslog.conf file is:
local5.emerg /var/log/spantree
NMS-A01 © 2005 Cisco Systems, Inc. All rights reserved. 31
Convert a Syslog Message
to a SNMP Notification?
• Why?
Not all error messages are supported via notifications
Syslog daemon not running in the NMS
Events correlation need
• Send a trap/inform from the CISCO-SYSLOG-MIB
when a new Syslog message is generated
• How to convert to a trap?
Router (config)# snmp-server enable traps syslog
• How to convert to an inform? Attention to the
<all> Keyword !!!
Router (config)# snmp-server host <x.x.x.x>
informs version 2c public syslog
NMS-A01 © 2005 Cisco Systems, Inc. All rights reserved. 32
Syslog Writing to Flash
• System error and debug messages saved on the
router’s CompactFlash disks (also known as ATA
Flash disks)
• Persistent across reboot
• Introduced in 12.0(26)S
Router(config)# logging buffered
Router(config)# logging persistent url
disk1/:syslog size 134217728 filesize 16384
Router# copy slot0:/syslog
ftp://myuser/
[email protected]/syslog
NMS-A01 © 2005 Cisco Systems, Inc. All rights reserved. 33
Syslog Issue
Consistent Message Format
• Syslog isn’t consistently used across different
Cisco platforms and Cisco IOS versions
Example: environmental monitor initiated shutdown event
Cisco IOS 11.2 ENVM-1-SHUTDOWN
Cisco IOS 12.0 ENVM-0-SHUT
NMS-A01 © 2005 Cisco Systems, Inc. All rights reserved. 34
How to Find Out About Syslog Messages?
• ‘Cisco IOS Software System Error Messages’ per
Cisco IOS release
For Cisco IOS version 12.2:
http://www.cisco.com/en/US/partner/products/sw/iosswrel/ps1835/
products_system_message_guide_book09186a008009e73d.html
• ‘System message’ per Cisco switch, Cisco 6000 switch:
http://www.cisco.com/en/US/partner/products/hw/switches/
ps700/products_system_message_guide_chapter09186a00800f27
09.html
• Error Message Decoder
http://www.cisco.com/cgi-bin/Support/Errordecoder/home.pl
• Output Interpreter
https://www.cisco.com/cgi-bin/Support/OutputInterpreter/home.pl
NMS-A01 © 2005 Cisco Systems, Inc. All rights reserved. 35
