Changing Syslog message levels

Greetings earthlings
My master's Nexus 7000 devices are churning out thousands of messages towards our syslog; these messages are bogus and need to be dismissed (warnings of our pen testing server hitting them on standard SNMP strings PUBLIC and PRIVATE)
Is there a way to fine tune the switch's categorization of these messages like there is on the Cisco ASA appliance? I'd like to raise these syslog messages to level 6 so they bypass our syslog.
May the schwartz be with you.

Sorry but AFAIK on NX-OS you can only do the standard - deciding what message levels are sent to syslog servers. This is described here.

Similar Messages

Firewall clock change-- syslog message

Is there any way to log clock changes on PIX/ASA. In IOS there is message
%SYS-6-CLOCKUPDATE: System clock has been updated from
But i cant find that on PIX/ASA
I know that i can log when user chage clock via comman prompt(logging commands) but i would like to log any change to system clock including when NTP server updates clock.
BR
Filip

Filip ,
I guess it should be covered under notifications but you can try options.
ciscoasa(config)# logging buffered ?
configure mode commands/options:
<0-7> Enter syslog level (0 - 7)
WORD Specify the name of logging list
alerts
critical
debugging
emergencies
errors
informational
notifications
warnings

RME (LMS 3.2) No detect Change Configuration automatically by Syslog Messages

Hi,
I have a problem with the "change audit" for Syslog messages trigger. I set all my devices to send Syslog messages to the CiscoWorks server. When I make any changes to syslog message is sent correctly for the CiscoWorks server, but it does not start automatically collects configuration (config fetch).
Only when I start manually "sync archive" the configuration is stored and detected the change in configuration.
Has not changed anything in config fetch "to" Automated actions Syslog ".
Thanks

Hi,
You an check RME > Tools > Syslog > Automated Actions to verify nothing was changed.
Then display 'Config Fetch'. There is contextual help available:
http://:1741/help/rme/fundamentals/index.html?syslog_Defining_Automatd_Actions.html#wp1211314
Nick

ACE Syslog message for State change

Hi,
Is there a syslog message for a state-change for rservers, if so how could we enable this?
e.g. when probe fails state changes to 'probe-failed'
when all probes are successful state is 'operational'
Thank you
Bilal

Hi,
There is a syslog message something like below:
%ACE-3-251006: Health probe failed for server 10.80.10.10 on port 80 internal error: failed to setup a socket.
First enable logging on ACE.
ACE/Admin(config)# logging enable
http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/config.html#wp1063750
read the section: Specifying Syslog Output Locations
logging buffered 3 should generate syslog in event of probe failure.
You can also set snmp to monitor it.
cesRealServerStateChange
CISCO-ENHANCED-
SLB-MIB
State of a real server configured in a server farm changed to a new state as a result of something other than a user intervention. This notification is sent for situations such as ARP failures, probe failures, and so on.
Hope that helps.
regards,
Ajay Kumar

ACE : PROBE-FAILED and Syslog messages

Hi,
When a real server is in PROBE-FAILED status, I observe a syslog message at each trial of the proble. This fills our syslog server. Is there a mean to configure the ACE in such a way that a syslog message would be generated only when a transition occurs in the probe status ?
Thank you for any hints,
Yves

Hello,
You can utilize "logging trap " command and
"logging message level " command
in order to achive what you are seeking.
The "logging trap " command limits the logging messages sent to a syslog server based on severity.
If it is set to "5 - notification", all messages that have security level of 5 or lower number are sent to the syslog server.
You can disable the display of a specific syslog
message or change the severity level of a specific system log message using
"logging message level " command.
Not sure what kind of probe you are using but If it is ICMP probe and
the reason of probe failure is arp, it generates a message for every try
as below with severity level of 3, by default.
%ACE-3-251009: ICMP health probe failed for server 192.168.0.1, connectivity error: ARP not resolved for destination ip address
%ACE-3-251009: ICMP health probe failed for server 192.168.0.1, connectivity error: ARP not resolved for destination ip address
%ACE-3-251009: ICMP health probe failed for server 192.168.0.1, connectivity error: ARP not resolved for destination ip address
%ACE-3-251009: ICMP health probe failed for server 192.168.0.1, connectivity error: ARP not resolved for destination ip address
%ACE-3-251009: ICMP health probe failed for server 192.168.0.1, connectivity error: ARP not resolved for destination ip address
%ACE-5-441002: Serverfarm (SF) is now back in service in policy_map (fs) -->
class_map (#class_default_slb). Number of failovers = 0, number of times back in service = 0
%ACE-4-442007: VIP in class: 'VIP' changed state from OUTOFSERVICE to INSERVICE
%ACE-5-441002: Serverfarm (SF) is now back in service in policy_map (fs) -->
class_map (#class_default_slb). Number of failovers = 0, number of times back in service = 0
%ACE-4-442004: Health probe ICMP detected rserver r1 (interface vlan31) changed state to UP
%ACE-4-442001: Health probe ICMP detected r1 (interface vlan31) in serverfarm SF changed state to UP
If your "logging trap " is set to "5 - notification" and you do not want
the message "%ACE-3-251009:xxx" to be sent to syslog server,
you can change its security level like below.
switch/Admin(config)# logging message 251009 level 6
switch/Admin(config)# do show logging message 251009
Message logging:
message 251009: current-level 6 default-level 3 (enabled)
You can check the message id that is filling the syslog server
and change its security level to higher number than "logging trap ".
Regards,
Kimihito.

Syslog Messages Not Appearing

Hi, I'm hoping someone can help me get my syslog messages to appear when I'm logged into the switch via SSH on a Cisco 4510R Switch. The ones that appear when I shutdown/no shutdown interfaces, leave global config mode, all the basic messages I'm used to seeing when logged in via console, telnet, or ssh.
The show run command displays logging console critical, which is the default of (2) I believe.
In global config, I set logging monitor 2, and also tried both console and monitor at level 5. Nothing is showing up.
Show logging displays all the latest messages, but I'm used to these showing up as things are configured.
This is the way the switch was set up prior to my working here.
Does anyone have any idea why this, and how I can get it working?
Thanks.

According to your configuration guide the default is debugging ie. level 7 so I suspect this has been changed.
In regards to your question if you are logged in via a vty line then you need to change the monitor level but then you may also need to type -
"terminal monitor" or "term mon" for short.
if you want turn it off -
"terminal no monitor"
Jon

Cisco PI 2.0 change syslog port

Hi,
is there a way to change the port on which PI 2.0 is listening for syslog messages? By default it is listening on UDP 514.

It doesn't look to be configurable even from the OS level. Even if it were, changing it might break the function in PI itself.
I poked around and the syslog|config.properties file does not specify it. It appears that the process syslog_daemon is listening on UDP 514 and unless someone knows differently I'd guess that's built into it's binary image (or at least the way the server calls the daemon when starting).
ade # pwd
/opt/CSCOlumos/conf
ade # cat syslog_config.properties
fileLocation=$XMP_HOME/decap/data/
circularBufferStreamName=SyslogProc_Java_Main_514
filterFileName=$XMP_HOME/conf/syslog_sev_filter.xml
syslogReaderName=syslogReaderName
partitionRange=0ade #
ade # pwd
/opt/CSCOlumos/da/bin
ade # ls -al
total 2196
drwxr-xr-x 2 root root    4096 Nov 21 11:01 .
drwxr-xr-x 8 root root    4096 Nov 21 11:21 ..
-rwxrwxrwx 1 501 named 237482 Aug 16 07:38 cdb_convert
-rwxrwxrwx 1 501 named 639405 Aug 16 07:38 cdbq
-rwxr-xr-x 1 501 named 554851 Aug 16 07:44 da_daemon
-rwxr-xr-x 1 501 named 21193 Dec 12 2012 savecapture
-rwxr-xr-x 1 501 named 311095 Aug 16 07:44 seed_cb
-rwxr-xr-x 1 501 named 446231 Apr 1 2013 syslog_daemon
ade #

Changing the Dunning level and reports for Dunning

How can I change the 'Dunning level' for line items in the 'Dunning History/Dunning overview'? I have read in help.sap that I can change it, but am not able to find where I could do that.
link: http://help.sap.com/erp2005_ehp_03/helpdata/EN/bc/2127c4265911d286d6006008bbc8e8/frameset.htm (In 3rd para).
Can anyone tell me if there are any reports available to view the 'Dunning list'(other than Dunning History in F150).
Also, Our client needs a report which shows a list of all 'customers' and 'line items' Blocked for Dunning.
Please give me your suggestions ASAP.
Thanks
Edited by: sapfan 20062007 on May 3, 2008 10:39 PM

Thanks .
I'm looking at running the ALFS editor . I'm in WebAS 7.00 . The Themes/templates and brand colours on the left frame does appear but the bsp page does not appear . used the standard bsp page which appears as a default ( bsp add it05 ) . The error message is as follows
The following error text was processed in the system:
BSP Exception: Das Objekt entrypoint.htm_sap-themeRoot=/sap/public/bc/ur/design2002/themes/alfs1000101F5FFFA2F4F4F2929296F8FAF3F5F7F in der URL /sap/bc/bsp/sap/it05/entrypoint.htm&sap-themeRoot=%2fsap%2fpublic%2fbc%2fur%2fdesign2002%2fthemes%2falfs1000101F5FFFA2F4F4F2929296F8FAF3F5F7F ist nicht gültig.
But if I run the bsp application manually then the right theme does get picked up . I made the entry in the bspthemeroot table and put in the alfs parameter in the above url ( 1000101F5FFFA2F4F4F2929296F8FAF3F5F7F ) . The bsp application works fine but not the alfs editor . Any ideas ?

Invoking a message-level secured webservice WS Security

I am not having any luck invoking a webservice that has been secured via message-level security. For simplicity, I have been using WS-Security Policies provided by WebLogic and applying them on my webservice via annotations. I have been testing with Wssp1.2-Wss1.0-X509-TripleDesRsa.xml. I am using soapUI to invoke the webservice. When I send a singed soap request, I get a response indicating that it wasn't able to validate the signature. I made sure that both soapUI and WebLogic server is using the same identity store. I have also made sure that the certificate in the identity store is also in the trust store for WebLogic. There could also be a problem with the structure of the soap request. I send a soap request that includes a signature of the timestamp, the initiator token (x509 in binary form), and the body.
Anyone have luck with WebLogic webservice security and soapUI?

Applying 'format XML' after signing it changes the message and makes the signature invalid, different content == different signature.
You should also ask yourself why you'd like to transport blank characters (zero information) over the wire just to make it more readable for yourself? Just compare the size of the unformatted and formatted message to see the waste of bandwidth.
--olaf

Error during transport-Structure change at field level (convert table /BIC)

Hi,
I am trying to transport from DEV to Test when I encountered this error.
The tables are both consistent when I checked with SE14.
Start of the after-import method RS_CUBE_AFTER_IMPORT for object type(s) CUBE (Activation Mode)
Error/warning in dict. activator, detailed log > Detail
Structure change at field level (convert table /BIC/DZCRUSDI026)
Table /BIC/DZCRUSDI026 could not be activated
Return code..............: 8
Following tables must be converted
DDIC Object TABL /BIC/DZCRUSDI026 has not been activated
Error when activating InfoCube ZCRUSDI02
Error/warning in dict. activator, detailed log > Detail
Structure change at field level (convert table /BIC/DZCRUSDI023)
Structure change at field level (convert table /BIC/FZCRUSDI02)
Table /BIC/DZCRUSDI023 could not be activated
Table /BIC/FZCRUSDI02 could not be activated
Return code..............: 8
Following tables must be converted
DDIC Object TABL /BIC/DZCRUSDI023 has not been activated
Error when resetting InfoCube ZCRUSDI02 to the active version
How do I resolve this
thanks

Hi,
There are no Inactive objects in the cube in DEV system. Also must of the changes I made in Test are already in the cube in TEST But the cube is not active.
SAP proposed that the cube be activated manually but is not a good procedure to activate in TEST system.
Error when resetting InfoCube ZCRUSDI02 to the active version
Message no. RSO410
Diagnosis
Errors arose when activating InfoCube ZCRUSDI02. An active version already existed before the activation.
System Response
InfoCube ZCRUSDI02 could not be reset to the old active version. Since the generated objects no longer correspond to the old active version, they were reset to inactive.
Procedure
The old active version of InfoCube ZCRUSDI02 can no longer be used. Remove the cause of the activation error and activate InfoCube ZCRUSDI02 anew.
thanks

Unterstanding syslog messages from our wlc

Hello,
we use two wlc 4402 (4.1.181.0) and several leightweight accesspoints (AIR-AP1010-E-K9 and AIR-AP1030-E-K9 ) connected to them.
On our syslog server we get a lot of messages from the two wlc, and there are 3 message types which I am a little bit afraid of.
1. ca. 10 times per hour we get the message
apf_80211.c:4792 APF-6-NO_CONFIG_CHANGES: Not saving 'apf.cfg' - no config changes."
Cisco system message guide:
Error Message %APF-6-NO_CONFIG_CHANGES: Not saving '[chars]' - no config changes.
Explanation Not saving - no config changes.
Recommended Action No action is required.
Does anybody know why we get this messages and if it's possibly to suppress them?
2. Intermittently (several times a day) we get the following message types:
a) [ERROR] spam_l2.c 723: Max retransmissions reached on AP 00:0B:85:56:63:40 (CONFIGURE_COMMAND^M , 2)"
b) [ERROR] spam_tmr.c 569: Did not receive hearbeat reply from AP 00:0b:85:56:ae:40"
The MAC address is not every time the same but one of our accesspoints.
On our network management system we get the following trap messages with nearly exactly the same timestamp:
14.01.2008 04:21:56 CET
AP ''00.0b.85.56.63.40'', interface ''0x1'' is down.
When Airespace AP's interface operation status goes down this trap will be sent.
bsnAPDot3MacAddress = 00.0b.85.56.63.40
bsnAPIfSlotId = 0x1
14.01.2008 04:21:56 CET
AP disassociated from Switch.
When an Airespace AP disassociates from a Airespace Switch, the AP disassociated notification will be sent with the dot3 MAC address of the Airespace AP. This will notify the management system to remove Airespace AP from this Airespace Switch.
bsnAPMacAddrTrapVariable =
14.01.2008 04:22:25 CET
AP associated with Switch.
When an Airespace AP Associates to a Airespace Switch, the AP associated notification will be sent with the dot3 MAC address of the Airespace AP. This will help the management system to discover the Airespace AP and add it to system.
bsnAPMacAddrTrapVariable =
bsnAPPortNumberTrapVariable = 1
Cisco system message guide:
a) Error Message %LWAPP-3-TX_ERR3: Max retransmissions for LWAPP control message reached on AP [hex]:[hex]:[hex]:[hex]:[hex]:[hex] for [chars] (number of pending messages is [dec])
Explanation Maximum number of times an LWAPP control packet is transmitted before declaring the AP dead has been reached for this AP. The AP may not be on the network, or might have rebooted.
Recommended Action Check if the AP has rebooted or if it has been removed from the network, or if there are connectivity issues between the AP and the controller.
b) Error Message %LWAPP-3-ECHO_ERR: Did not receive heartbeat reply; AP: [hex]:[hex]:[hex]:[hex]:[hex]:[hex]
Explanation Controller did not get a response for the AP heartbeat message. There may be connectivity issues between the AP and the controller.
Recommended Action Check if the AP has rebooted or if it has been removed from the network, or if there are connectivity issues between the AP and the controller.
Because we don't see any network problems I'm wondering why the connection is lost.
Does anybody have an idea, perhaps CSCsh13928 (http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsh13928, but we don't have much traffic on the wlans) ?
Is there any possibility to remotely check if the accesspoint rebooted?
If you need further information please give me a short feedback.
Many thanks in advance,
Thorsten Steffen

Thanks for the help.
I have set up to send email and syslog messages from the RME applications. LMS server immediately started to send messages to the email server but syslog messages are not forwarded to the syslog server. Everything was done according to your instructions except that the name of the first script (syslog_forward.pl) is made consistent with what the second script (.bat) refer to (forward1.pl). What's the problem? Do RME sends the standard syslog messages via UDP port 514?
Sincerely.

LMS 4.2 not processing syslog messages

I have a new install of LMS 4.2 on a virtual appliance. No syslog messages are getting into LMS. They are being received by the server, but are showing up in /var/adm/CSCOpx/log/dmgtd.log, and aren't getting processed by SyslogAnalyser.
Here's the syslog.conf file:
     local6.info                                                                     /var/log/ade/ADE.log
     *.info;mail.none;news.none;authpriv.none;cron.none;local0.none;local1.none      /var/log/messages
     authpriv.*                                                                      /var/log/secure
     mail.*                                                                          -/var/log/maillog
     cron.*                                                                          /var/log/cron
     *.emerg                                                                         *
     uucp,news.crit                                                                  /var/log/spooler
     local7.*                                                                        /var/log/boot.log
     #Application LMS Generated config
     #BEGIN CSCOmd - DO NOT EDIT THESE COMMENTS OR CONTENTS CONTAINED WITHIN - local0 1
     local0.emerg;local0.alert;local0.crit;local0.err;local0.warning;local0.notice;local0.info;local0.debug /var/adm/CSCOpx/log/dmgtd.log
     #END CSCOmd DO NOT EDIT BEFORE THIS LINE 1
     local7.info /var/log/syslog_info
My guess is that the incoming messages are getting written to the wrong file. What do I need to change to correct this?

I found that all of my syslog messages were being captured under /var/log/messages. This was due to my Cisco devices being configured with "logging facility local5". Instead of reconfiguring all of my devices to log to facility local7, I just changed the following line in syslog.conf and restarted (/etc/init.d/syslog restart)
Before:
local7.info /var/log/syslog_info
After:
local5.* /var/log/syslog_info
Probably not the best way to do it, but it worked for me.
-Rick

Syslog messages not showing

Hello,
I have a newly installed LMS 4.1 that had the Syslog feature working for a while.
Recently, the Syslog is no longer displaying any records (neither new or old messages).
Below are the steps I have tried to troubleshoot the problem:
- Installed wireshark : Syslog messages are being received by the LMS server on time
- In the Syslog.log file, I can see that all the Syslog messages are being logged properly
- I tried to disable all the "Syslog Message Filters" but nothing changed
In the SyslogCollector.log, I can find the below logs:
NMSROOT is C:/PROGRA~2/CSCOpx
propFileC:/PROGRA~2/CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\C:\PROGRA~2\CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties
Unable to find the file C:/PROGRA~2/CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\C:\PROGRA~2\CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties
NMSROOT is C:/PROGRA~2/CSCOpx
propFileC:/PROGRA~2/CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:38,673, Logging System Initialized.
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:38,674, System Initialized.
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:38,684, Queue Cap 100000
SyslogCollector - [Thread: main] WARN , 04 Mar 2013 14:54:45,468, Unable to resurrect connection to a subscriber.
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:45,491, Service started...
I am not sure what to check now. Kindly your suggestions.
Thanks,
Justine.

Hello,
I have a newly installed LMS 4.1 that had the Syslog feature working for a while.
Recently, the Syslog is no longer displaying any records (neither new or old messages).
Below are the steps I have tried to troubleshoot the problem:
- Installed wireshark : Syslog messages are being received by the LMS server on time
- In the Syslog.log file, I can see that all the Syslog messages are being logged properly
- I tried to disable all the "Syslog Message Filters" but nothing changed
In the SyslogCollector.log, I can find the below logs:
NMSROOT is C:/PROGRA~2/CSCOpx
propFileC:/PROGRA~2/CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\C:\PROGRA~2\CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties
Unable to find the file C:/PROGRA~2/CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\C:\PROGRA~2\CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties
NMSROOT is C:/PROGRA~2/CSCOpx
propFileC:/PROGRA~2/CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:38,673, Logging System Initialized.
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:38,674, System Initialized.
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:38,684, Queue Cap 100000
SyslogCollector - [Thread: main] WARN , 04 Mar 2013 14:54:45,468, Unable to resurrect connection to a subscriber.
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:45,491, Service started...
I am not sure what to check now. Kindly your suggestions.
Thanks,
Justine.

Solaris 9 syslog messages are IP not hostname

I am trying to setup Solaris 9 to forward its syslog messages to a central server, and its working fine except the logs being sent have the IP address and not the hostname. Is there a way to change this? Thanks

no, i mean you will need to put entries for the remote hosts on your central server, or set up IN NS records in your nameserver for reverse mappings from IP -> host (not host -> IP).
Shouldn't need any switches or config changes to syslogd for it to work.
Also, check your /etc/nsswitch.conf file has at least "files dns" set for hosts.

ASR1000 CUBE SP syslog messages

Hi,
we're trying to integrate our SBC instances (CUBE SP on ASR1000) into our network management system (EMC SMARTS)
Syslog messages from SBC instances are some kind of cumbersome with lot of line breaks resulting in multiple syslog messages the NMS must parse.
Example:
%SBC-3-MSG-6406-0006-ADD5A3-1575
Message Editor received a message with an unknown editor in
the edit sequence. The editor will be ignored.
Editor name: default
How do I configure it to just put it all into one line just as "normal" log messages?
Example:
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0/0, changed to up
Thanks
Sebastian

Hi,
thanks for replying.
I went already through this, seems I have to write some kind of script to get SBC messages into one line.
Do you have an idea for this very simple task?
Still wondering I'm the first to stimble upon it
Sebastian

Changing Syslog message levels

Similar Messages

Maybe you are looking for