Cisco PI syslog server configuration

Hi all,
I need to configure the PI as syslog server and get the log file from the PI to read it ??
how can I do it, please advice
thanks in advance

Hi,
Which prime version are you using ?
Here is what Prime 2.1 user guide says
http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/2-1/user/guide/pi_ug/alarms.html#pgfId-1054572
Prime Infrastructure logs all emergency, alert, and critical messages generated by all devices that are managed by Prime Infrastructure.
Prime Infrastructure also logs all SNMP messages and syslogs it receives. To view syslogs, choose Operate > Alarms & Events , then click the Syslogs tab.
Syslog Predefined Filters
Prime Infrastructure uses the following syslog filters:
Severity 0 and 1
Severity 2
Environmental Monitor
Memory Allocation Failure
Catalyst Integrated Security Features
Cisco IOS Firewall Denial of Service
Read this thread as well, it talks about tweak this setting, but it could leads to fill up your prime disk space quickly.
https://supportforums.cisco.com/discussion/11645481/prime-infrastructure-12-syslog
HTH
Rasika
**** Pls rate all useful responses ****

Similar Messages

Cisco Prime syslog server

Where are syslogs stored, if I point my devices to Cisco Prime acting as my syslog server? I am running 2.0
thanks, Jerry

Hi ,
As of now , this feature is not available , I mean PI will not work as syslog server.
Syslog messages received by PI from managed devices are found under Monitor > Alarms and Events > Syslogs
as you are using PI 2.2 , you will be able to see all device syslog messages (0-7 severity)
That display will show you up to 200,000 messages at a time.
Check the below link for other related details proved by Marvin :
https://supportforums.cisco.com/discussion/12486126/cisco-prime-syslog-functionality#sthash.Wbj2a3lj.dpuf
Thanks-
Afroz
***Ratings Encourages Contributors ****

Cisco ACS 1121 server configuration

Hi,
Anyone can tell me how to configure LAN teaming in Cisco ACS 1121. My requirement is to have virtual IP in the server with two physical IPs in the available 2 interface in the server.
Regards,
Haja Shajahan.M

Currently Gig 0 is supported. Gig 1 is blocked. Check this link ((Blocked) Gigabit Ethernet 1).
http://www.cisco.com/en/US/partner/docs/net_mgmt/cisco_secure_access_control_system/5.2/installation/guide/csacs_hw_ins.html#wp1119105
Paps

ACS appliance1120 ACS 4.2.1.15 syslog message to syslog server

Hi All ,
I am using ACS 1120 appliance running ACS version 4.2.1.15 , I am pointing out all syslog message to my external syslog server (passed authentication , failed authentication , database replication , administration aduit ,tacacs accounting ) , but i could recieve only passed authentication log message to my external log server , no other log message except passed authentication is pushed to my external log server , But i could see failed attempts , database replication,administrtation audit log message locally on my acs appliance as CSV file ,
Syslog server configuration is configured under all logging (passed , failed , administration , tacacs accounting ) , but i am surprise to see only passed authentication logg is sent out from acs appliance , Is there any patch to be installed for logg message scripting ?? , please advise ..

Refer the link : https://supportforums.cisco.com/discussion/11513026/migrating-acs-420-421
you can directly upgrade from 4.2.0.124 to 5.6 : http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-6/user/guide/acsuserguide/migrate.html#98379

Configuring Cisco Router for use with Syslog Server

Configuring Cisco Router for use with Syslog Server:
Does anyone know of a good doc for this?
-Ashley

Start with that one: http://security-planet.de/wp-content/uploads/2008/12/logging-ios.pdf
And if you need more informations, just ask what you want to achieve.
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Configure Cisco Works as a Syslog Server ???

Hi Friends,
Is it possible to configure syslog server in Cisco Works,if possible please share the steps need to be configutreed..

Syslog server in ciscoworks is pretty simple.
> Configure device to send syslog to ciscoworks
> Subscribe Syslog Collector in Ciscoworks
> Set correct filters and Generate report to see syslogs.
When Syslog is recived in Syslog.log(win)/Syslog_info(sol/lin) Syslog collector pics syslog message from that flat log/text file and send it to Syslog Db after filtering messages as per filter settings.
Subscribing Syslog Collector however differs with LMS version. Please see:
LMS 3.x :
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_resource_manager_essentials/4.3/user/guide/syslog.html#wp1123042
LMS 4.x:
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.2/user/guide/admin/collection.html#wp1059476
Syslog Documents for Ciscoworks:
http://docwiki.cisco.com/wiki/Network_Management_Configuration_Example_for_Ciscoworks_LMS_Syslog_Configuration_via_GUI
http://www.cisco.com/en/US/products/sw/cscowork/ps2073/products_tech_note09186a00800a7275.shtml
-Thanks

Cisco ISE and external syslog server

Hi Security Experts,
We are starting with deploying cisco ISE (Identity Services Engine) in our network. We have allocated 250GB space for (Admin+Monitor) ISE node.
I want to know if we can send the logs from monitoring node to external syslog server after a defined time interval.
For example, logs which are more than 10 days old should be sent to external syslog server. So basically our monitoring node will have logs which are at the max 9 days old. Is it possible? Could you point me to some doc which explains configuration of the same?
Thanks,
Kashish

No this isnt possible via syslog. What you are looking for is database purging, so that the monitoring database is purged after a specific time interval. Here is a guide that will help shed some light on this:
http://www.cisco.com/en/US/docs/security/ise/1.1/user_guide/ise_mnt.html#wp1054328
Tarik Admani
*Please rate helpful posts*

Configuration required in Cat 4006 to forward errors to syslog server

Hi,
I have setup a Kiwi syslog server. I want to configure in my Cat 4006 switch to forward the following messages to my syslog server
1. configuration changes
2. Vlan creation /modification
3. Power supply failures/module failures/temperature
4. When the processor utlization exceeds more than 75% , it should send a alert message to syslog server
5. Switch restart
6. Trap for any changes in Uplink ports only. There are 4 uplinks to other Switches from 4006. If any problem with these ports (uplink), it should send message to syslog server , not for all ports
Thanks in advance
Raju

Hi
I feel this link will be of some help to u in configuring different severity levels for different facilities available.
http://www.cisco.com/en/US/partner/products/hw/switches/ps663/products_configuration_guide_chapter09186a00800d81c8.html
By default for abnormal temp conditions u will get logs in the syslog server if u have already pointed the logs to the syslog server..
regds

How to configure IPS 4240 - K9 to send log file to syslog server

I am looking for the commands in how to configure IPS 4240-k9 to send log file to SYSLOG server. If anybody has or came across similer issue please advice.
Thanks in advanced.

Ali -
I am sorry to tell you, but the Cisco IPS Sensors do not send Syslog messages. Your only options for sending signature event information are:
SDEE (an TLS Encrypted XML formatted message) the sensor is the SDEE Host and your event receiver (MARS, IME, Intelitactics, etc) is the client.
SNMP Traps - You need to set the "Action" on each signature you want the sensor to send a trap.
- Bob

Trap messages to syslog server cisco WS-C4503 - 3750x

All,
I have issue with respect to SNMP trap , below is the histroy
SW1 -- trunk port Gi 2/11 ( old switch )
SW2- trunk port Gi 1/0/2 ( old switch)
recently SW2 got replaced
SW1 -- trunk port Gi 2/11 ( old switch )
SW2- trunk port Gi 1/1/2 ( new switch)
SYSLOG server still recieving trap message saying that trunk port between SW1 2/11 to SW2 Gi 1/0/2 is down , however SW2 trunk currently on the new port Gi 1/1/2 . bit wondering on this . the new switch Gi 1/0/2 which is currently access port and it is not connected to any host machine since installed and no logging port flap information ( sh logging output) is something need to be done at switches to clear log message at server . please advice
below is the port configuration
SW1 ( OLD)
interface GigabitEthernet2/11
description *******
switchport mode trunk
switchport nonegotiate
SW1#sh run | in trap
logging trap debugging
snmp-server enable traps snmp linkdown linkup coldstart warmstart
snmp-server enable traps envmon fan shutdown supply temperature
snmp-server enable traps hsrp
snmp-server enable traps mac-notification change move threshold
SW2 ( NEW switch )
interface GigabitEthernet1/0/2
switchport mode access
switchport nonegotiate
load-interval 30
spanning-tree portfast
spanning-tree bpduguard enable
spanning-tree guard root
SW2#sh run | in trap
snmp-server enable traps snmp authentication
snmp-server enable traps config
snmp-server enable traps hsrp
snmp-server enable traps bridge newroot topologychange
snmp-server enable traps stpx inconsistency root-inconsistency loop-inconsistency
snmp-server enable traps vtp
snmp-server enable traps vlancreate
snmp-server enable traps vlandelete
snmp-server enable traps flash insertion removal
snmp-server enable traps envmon fan shutdown supply temperature status
snmp-server enable traps vlan-membership

Hi
I feel this link will be of some help to u in configuring different severity levels for different facilities available.
http://www.cisco.com/en/US/partner/products/hw/switches/ps663/products_configuration_guide_chapter09186a00800d81c8.html
By default for abnormal temp conditions u will get logs in the syslog server if u have already pointed the logs to the syslog server..
regds

Can Cisco Prime Infra 2.1 work as syslog server

Hello all,
Customer want Cisco Prime Infra 2.1 to work as syslog server. they want to query text in syslog and get raw log file from Cisco Prime Infra. but when i see in user interface. I think that it cannot query and search text in syslog. but i am not sure whether we can get raw log file per devices from Cisco Prime Infra. Can anyone know about this.?
thanks
sompoj

Hi Sompoj,
In the prime infrastructure Syslogs are directly read from udp port 514 and then filtered
, the non SEV1 and SEV2 syslogs will be dropped and will not be entered into db . The
syslog messages will not be saved into log files .
Thanks-
Afroz
****Ratings Encourages Contributors ****

Is cisco prime infrastructure support / can be run as syslog server?

Dear All,
is cisco prime infrastructure support / can be run as syslog server?
and,
where i can see network topology diagram, using cisco prime infrastructure?
many thanks,
Jerri

Hello. Cisco Prime LMS will be replaced by Cisco Prime Infrastructure in the near future.
In the current release of Cisco Prime Infrastructure you can't use topology diagrams. This feature is in roadmap.
About syslog, you can send syslogs to Cisco Prime Infrastructure, but I don't recommend using it as syslog server. Please see this link for more information https://supportforums.cisco.com/thread/2179520
Please rate if this helps

I need HELP configuring SanOs 203 and syslog server Please!

I have a kiwi syslog server on a windows 2003 server to which i can not get my switches to send messages to it.
can someone please help.
I tried to configure from the cli and from the DUI without any luck.

You say it does not configure or that it does not send messages when it is configured? Can you port a show log info. I do not have Kiwi syslog on my network but do run 3CDaemon with no problems with SAN/OS 2.0.3
Is syslog server ping-able from switch?

Cisco RV082 - How can I create SysLog server

I tried some online free Syslog server tools but fail to get router's statistics anybody can help me to create a Syslog server on my Windows 7 machine.

Hi Qamar,
Log in to the web configuration utility and choose Log > System Log. Then check the Enable Syslog check box to enable the syslog service on the device. Enter the domain name or the IP address of the syslog sever in the Syslog sever field.
To enable the router to send email alerts when events are logged, check Enable Email Alert.
This enables the router to send email alerts to the user specified email address. Enter the the IPv4 or IPv6 address of the SMTP server of your ISP in the Mail Server field. Enter the email address where you want to send the alerts in the Send Email to field. Enter the number of log entries to include in the email in the Log Queue Length field. The default is 50. Enter the number of minutes to collect data before sending the log in the Log Time Threshold field. The log time threshold is the maximum wait time before an email log message is sent. When the log time threshold expires an email is sent whether the email log buffer is full or not. The default is 10 minutes
Click Email Log Now to instantly send a message to the specified email address to test the settings.
You can configure the necessary Log Settings also .
Thank You.

Syslog server for Monitoring Cisco devices

I am looking for Syslog server to log all logs from Cisco devices. We have more than 800 cisco devices. Can anyone tell me what syslog server should i use to log these files.
Thank you.

Has anyone used the Cisco recommendation of Buliding Scalable Syslog Solutions?
http://www.cisco.com/en/US/technologies/collateral/tk869/tk769/white_paper_c11-557812.html#wp9000318
I used this in another organaztion and we were very successful, we currenlty use Netcool that feeds from a syslog and we get several non-actionable alarms and it's very time consuming for 13,000 devices. I would only like to alert on 0-5 Cisco Syslog messages. Below is the response from my Netcool Administrator (What are your thoughts?):
From my Netcool Administrator:
Regarding, using the Cisco syslog severity for alert control, I feel that is not the best way to control the work in Netcool.
1. -- Cisco is not consistent with the use of this value.
    Examples:
        In this case the important message is the lower severity alert: I would consider the BGP-3-NOTIFICATION of a 6 level of Informational
        Aug 4 03:10:01 rtgara02r01m04-lb0.us.bank-dns.com 001458: Aug 4 03:10:01: %BGP-5-ADJCHANGE: neighbor 10.93.69.106 Down BGP Notification sent
        Aug 4 03:10:02 rtgara02r01m04-lb0.us.bank-dns.com 001459: Aug 4 03:10:01: %BGP-3-NOTIFICATION: sent to neighbor 10.93.69.106 4/0 (hold time expired) 0 bytes
        This one is near the top level of serverity per Cisco but not all that severe in reality, further this syslog has a bug where the threshold is not even exceeded
        %ENVMON-1-CPU_WARNING_OVERTEMP: Critical Warning: CPU temperature 107C exceeds threshold 110C. Please resolve system cooling immediately to prevent system damage
        This one is reporting a standard condition:
        %ILPOWER-5-POWER_GRANTED: Interface Fa0/24: Power granted
        Here is an example of a 1 where the voice group says that nothing is wrong:
        Aug 4 13:08:42 rtgcaa75u01-01.sw.us.bank-dns.com 047489: Aug 4 11:08:41: %IVR-1-APP_PARALLEL_INVALID_LIST: Call terminated. Huntgroup \'1\' does not contain enough valid SIP end-points to proceed with a parallel call.

Cisco PI syslog server configuration

Similar Messages

Maybe you are looking for