Logs from Cisco Prime

Hi Team,
I am using Cisco Prime Infra 2.0. I want to find the logs related to LWAP Templete. We have 4-5 templets created. few days back one templete has been modified and the templete was pushed to all the AP's.
So i need to know when,How and Who has modified this templete.
I am trying to get logs from Admin-->Logging Page, But it has no info about this.
Please help me in getting this logs.
Thanks in advance
Regards,
Satya.M

Hi,
I found answer for this....
Viewing Audit Logs
Prime Infrastructure provides two types of audit logs:
•Application Audit logs—Logs events that pertain to the Prime Infrastructure features. For example, you can view the application audit log to see when a particular user logged in and what actions were taken.
•Network Audit logs—Logs events related to the devices in your network. For example, you can view the network audit logs to see which user deployed a specific template and the date and time the template was deployed
Hope it should be helpful to u as'll

Similar Messages

Collecting logs from Cisco Prime Infrastructure

Hi ,
I am currently working in integrating Cisco Prime Infrastruture with the siem tool Qradar.
Can any one help me out in below issues:
1)How and where is the log stored in Cisco Prime.?
2)Does the logs contains the logs of the devices that Cisco Prime manages?
3)Is there any way to sent out the logs from Cisco Prime to a third party device.?

Hi,
1)How and where is the log stored in Cisco Prime.?
/opt/CSCOlumnos/logs
2)Does the logs contains the logs of the devices that Cisco Prime manages?
AFAIK,
In the prime infrastructure Syslogs are directly read from udp port 514 and then filtered
, the non SEV1 and SEV2 syslogs will be dropped and will not be entered into db . The
syslog messages will not be saved into log files .
Till now PI support only SEV 0,1 and 2 syslog.
3)Is there any way to sent out the logs from Cisco Prime to a third party device.?
unfortunately , this feature is not there in PI so far.
Thanks-
Afroz
***Ratings Encourages Contributors ****

Unable to view IDS logs from cisco VMS server

Hi,
Pls help me out for viewing IDS logs from my cisco vms server (4th edition with SP2,java 1_4_1.02)
Configured IDS sensor with IDS MC (2.0.1) and updated signatures with latest sig files,
Configured Security monitor to view my IDS sensor and showing TLS was connected and cisco IDS REDP/SDEE,when viewing logs error was server codes need to be update., unreconiged last saved IDS alarms.
Pls give me the solution
Regards
Ajay

Hi Ajay,
when you upgrade to sec mon 2.0.1, the database is the same, but the formats are different.. you need to do somethings for converting these formats, which might take hours together, if ur database has too many events...
for information to convert the file format, refer to this URL:
http://www.cisco.com/en/US/products/sw/cscowork/ps3990/prod_release_note09186a0080386f72.html#wp1087204
see the section "Using the ConvertAndImport.pl Script after Upgrading from Security Monitor 1.2.3 to Security Monitor 2.0.1 "
do this and see.. let us know
Raj

Problem Exporting Backups from Cisco Prime LMS 4.2 deployed as software appliance

Hi,
I'm trying to backup a Cisco Prime LMS4.2 based on soft appliance. I have the backup stored on destination disk://localdisk/backup/, but i can't export it via FTP to external server. When I perfrom the transfer only the folder is stored in the destination path, the files aren't included. I think that i have to compress files on the backup folder as .tar file using linux shell, but i can´t find the backup folder from this shell.
It´s correct my procedure, if not What is the procedure and commands to export a backup to external server via FTP?
Thanks,

Hi Dave,
If your Goal is to upgarde the IOS of the devices via LMS then MANUALLY download the IOS Image from cisco.com
and use the FILE SYSTEM option to add the Image in the Software Repository
Then try to upgrade the IOS and see how it works.
Thanks
Afroz

Change Interface availability threshold from Cisco Prime Infrastructure 2.0

Dear Community,
I’m working in Cisco Prime Infrastructure 2.0 and I’m having the following problem:
I want to monitor the interfaces availability from all the devices of my network. But only makes sense send an email notification for the most critical interfaces. I don´t want to receive an email notification every time anyone unplugs the network wire.
How can I achieve this?
I already tried to change the interface availability threshold from the Interface Health Threshold Template, but this one isn´t available to configure.
The idea was to change the severity of the alarm so I could distinguish what type of alarm would send email notification.
I also created a Custom SNMP Template that gets the ifOperStatus using the MIB IF-MIB. This also didn’t work because Prime Infrastructure doesn’t allow me to define thresholds to a Custom SNMP Template.
Without threshold, no alarm, without no alarm, no email notification!
Can you help?
Regards,
Daniel CJ

Only on the HA pair which would be the secondary.
High Availability (HA) RTU: If Cisco Prime Infrastructure is deployed in a high availability configuration with one primary and one secondary instance in an HA pair, then an HA RTU is required. You only need to purchase a single set of the regular licenses (for example, Base, Lifecycle, and so on) for the primary instance.
Thanks,
Scott
Help out other by using the rating system and marking answered questions as "Answered"

Migrating from Cisco Prime Unified Provisioning Manager 9.0 BE to Prime Collaboration 9.0 Provisioning

Hi All,
    Cisco BE 6000 9.X support both Cisco Prime Unified Provisioning Manager 9.0 BE and Prime Collaboration 9.0 Provisioning as its management tool. OVA for both applications are pre-loaded on server from factory starting end of March 2013.
    For some customers that start with Cisco Prime Unified Provisioning Manager 9.0 BE, and want to migrate to Prime Collaboration 9.0 Provisioning for advanced features, they can follow the following guide for migration.
http://www.cisco.com/en/US/partner/docs/net_mgmt/prime/unified_provisioning_manager/9.0BE/migration/guide/migrate_90be_pc90.html
    For more collaterals for Cisco Prime Collaboration, please visit
http://www.cisco.com/en/US/partner/products/ps12363/index.html
Best
Jing

Finally, the solution of the problem was:
1-stop the daemon manager “net stop crmdmgtd”
2- Delete the xml files available under(please take backup from them) :
CSCOpx\objects\sir\work
CSCOpx\objects\topo\work
3-Start the daemon manager net start crmdmgtd (wait for 20 minutes until all process are up )

Upgrade from Cisco Prime infrastructure verion 2.0 to 2.1

Request you all to please let me know if i have to install point patch before upgrading the cisco prime infrastructure 2.0 to 2.1.

After moving to 2.1, there is a 2.1.1 point patch currently available.
You should install that and the latest device package (4.0 as of this posting).
As always, the Release Notes are the best place to check the current available updates.

Autonomous AP to lightweight ap conversion from Cisco Prime 2.0

Hi,
Is is possible to convert bulk number of APs from Autonomous to LWAPP simultaneously and what would be the template?
Kamlesh

Hi,
You talk about different things and then mix all of them...
H-REAP is a simple mode of an LWAPP AP.
The AP lwapp software is upgraded/downgraded automatically when you upgrade/downgrade the WLC software.
They do not need to be in the same subnet they only need to be reachable, and the AP needs to be joined to the WLC.
Whenever an AP joins to a WLC, the first thing it does is to see if it is running the corresponding version of software. If not, the AP will automatically download the corresponding image fro mthe WLC and reload with the correct version.
So there is nothing to do on the AP orhter than make sure it joins the WLC. Then they do the rest automatically.
Now, you say the AP is in rommon mode...this means there is no IOS at all installed, so at least you need a base image.
To get a base image into the AP you can follow the procedure:
http://www.cisco.com/en/US/docs/wireless/access_point/conversion/lwapp/upgrade/guide/lwapnote.html.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Flushing / Deleting Devices from Cisco Prime LMS4.1 - How ?

Hello,
Discovery got a little messed up when importing from LMS 3.1
Basically I want to flush all devices from all the different LMS modules.
If I delete all devices from Device Management they seem to stay in Topology Services / Device Discovery / Data Collection etc.. They keeps the old device in their own database.
Is there a way of flushing all devices from all these different modules. I'm going to re-import them with a clean CSV import file.
Cheers
Barry

It is confusing to everybody I think (except perhaps Joe Clarke). Perhaps Joe will jump in with a solution to this last bit.
Starting back when CiscoWorks instituted a DCR (ca. CiscoWorks 2000?) things began to integrate across the components but under the covers there are still separate bits. Alerts (e.g., those from Fault functions or the old DFM, based on the EMC SMARTS product) are notorious for using settings and a repository different from the rest of the suite. I've had good luck using a local hosts file for that component to work properly (i.e., generate fault records with the proper host name vs. the device IP).

Export Alarm/Event Data from Cisco Prime Infrastructure 2.1+

I am looking to export the current Alarm data for my CPI 2.1 deployment. This so we can go through and organize the data in excel and better configure alarm/events....currently getting 3k a week and we need to tighten what constitutes a critical event and some other parameters. We need the raw data in csv format so do some analytics on it.
My issue is there is no reference in the admin/user guides to export alarm data. Also no button or option within the GUI. How can this be accomplished?

The supported method going forward is to have external tools interact with Prime Infrastructure via the REST API.
See the documentation on your Prime server for "GET Alarms":
https://<your server address>/webacs/api/v1/data/Alarms?_docs
...or you can download a copy of the API Reference here.

SYSLOG Cisco Prime LMS

Hi friends,
I have a question about my syslog from Cisco Prime LMS 4.1, the hours from this syslog in the LMS is diferent from my switch log. I dont kown why.. I verified the hours betewen switch y the Cisco Prime is the same(the LMS is over Windows Server 2008R2) . both are the same log but in diferent hours about 5 hours.
maybe I have to configure the hours for Syslog in the Cisco Prime.
Log from Switch
Log from Cisco Prime LMS

If you have LMS, i am not sure, but if you have PI 1.2. Take a look at my post.
Basically, syslog feature doesn't work well. I could see couple of syslog through event / alarm, but syslog itself is not working properly.
https://supportforums.cisco.com/message/3861981#3861981

Can Cisco Prime Infra 2.1 work as syslog server

Hello all,
Customer want Cisco Prime Infra 2.1 to work as syslog server. they want to query text in syslog and get raw log file from Cisco Prime Infra. but when i see in user interface. I think that it cannot query and search text in syslog. but i am not sure whether we can get raw log file per devices from Cisco Prime Infra. Can anyone know about this.?
thanks
sompoj

Hi Sompoj,
In the prime infrastructure Syslogs are directly read from udp port 514 and then filtered
, the non SEV1 and SEV2 syslogs will be dropped and will not be entered into db . The
syslog messages will not be saved into log files .
Thanks-
Afroz
****Ratings Encourages Contributors ****

Cisco Prime: Event Larm Port 'x' is down on device.

Hi,
I'm writing regarding; event-larms; that is reporting from Cisco Prime; connected to controller. Interfaces is reporting via event-larm; that they are down.
"Virtual Domain: ROOT-DOMAIN
PI has detected a change in one or more alarms of category Controller and severity Critical in Virtual Domain ROOT-DOMAIN.
The new severity of the following items is Clear:
1. Message: Port '3' is down on device '10.1.1.2'.
(6 times)
2. Message: Port '4' is down on device '10.1.1.2'.
(6 times)
3. Message: Port '5' is down on device '10.1.1.2'.
(6 times)
4. Message: Port '6' is down on device '10.1.1.2'.
(6 times)
5. Message: Port '7' is down on device '10.1.1.2'.
(6 times)
6. Message: Port '8' is down on device '10.1.1.2'.
(6 times)
E-mail will be suppressed up to 30 minutes for these changes."
Is there a solution how to not recieve those event-larms? The only LACP interfaces that is configured is 1 & 2, in a group.
See attached screenshot, when trying to disable the other interfaces.
The LACP is enabled and configured on "management" interface.
Best Regards,
David

From: https://supportforums.cisco.com/discussion/12077376/prime-infrastructure-alarm-port-down#comment-9405836
"As far as I understand the error message you only need to disable SSO before you can disable the LAG ports."
"(Cisco Controller) >config port adminmode 3 disable
Blocked: Lag is enabled. Disabling the lag port is blocked when system is in redundancy state (SSO)"
"I would suggest to do this only in a maintenance window."

Cisco Prime 2.1 problem with API/Client

Hi,
im having a problem with the API output i get from Cisco Prime Infrastructure. The URL im trying to GET info from is:
https://<URL>/webacs/api/v1/data/Clients
The output shows that im missing data from a specific ID. Example:
{"@url":"https:\/\/prime.lmv.lm.se\/webacs\/api\/v1\/data\/Clients\/1280389614","@type":"Clients","$":"1280389614"}
Then i try to GET the info regarding this ID: https://<URL>/webacs/api/v1/data/Clients/1280389614
{"errorDocument":{"httpResponseCode":500,"httpMethod":"GET","message":"No such entity as Clients \/ 1280389614.-PRS-101","id":"presentation.PRS-101","uriPath":"data\/Clients\/1280389614","queryParams":"{}"}}
So something is wrong here, so when i add ".full=true" parameter i get the following error as it cannot show the client data:
https://<URL>/webacs/api/v1/data/Clients.json?.full=true&.firstResult=1000&.maxResults=1000
{"errorDocument":{"httpResponseCode":500,"httpMethod":"GET","message":"Exception while invoking valueOf method 'getEnum' of enumeration class 'class com.cisco.ncs.nbi.client.ClientProtocolEnum'; nested exception is org.hibernate.HibernateException: Exception while invoking valueOf method 'getEnum' of enumeration class 'class com.cisco.ncs.nbi.client.ClientProtocolEnum'","exception":"org.springframework.orm.hibernate3.HibernateSystemException: Exception while invoking valueOf method 'getEnum' of enumeration class 'class com.cisco.ncs.nbi.client.ClientProtocolEnum'; nested exception is org.hibernate.HibernateException: Exception while invoking valueOf method 'getEnum' of enumeration class 'class com.cisco.ncs.nbi.client.ClientProtocolEnum'","uriPath":"data\/Clients","queryParams":"{.full=[true], .firstResult=[1000], .maxResults=[1000]}"}}
Any idea how to solve this issue, how can i find the client that is causing this problem? In my script im reading all the clients in the network to a third party application. But right now its hard to get this output in a smart way. It might be resolved in 2.2, but it feels like the data i corrupt in some way so i doubt that this error is related to the version?
Best Regards // Mattias Andersson

Hi,
I have also run into this problem on two different Prime 2.1-systems when trying to get all Client-data available. I haven't figured out a way to fix it more than making small calls (.maxResults=100) then trying to pin-point and skip the ID giving the error. I've been using 2.2 for a while now but haven't tested the Client-API that much yet. I'll experiment some more on it and see if I can recreate the problem to see if it's related to the version.

Can i install Cisco prime infrastructure 1.3 with 1.1 license.

Can i install Cisco prime infrastructure 1.3 with 1.1 license.To be more precise it will be fresh installation
but the licenses I have is of 1.1.As per my overview from Cisco prime Infrastructure 1.2 NCS and NCS(WAN)
has been bundled into one service.But both were seperate entities in Cisco Prime Infrastructure 1.1.

It doesn't matter if you want to make a new installation or an upgrade. The questions is the license.
The base license is necessary for network management nodes (devices). But to get updates for your system you need the additional to your Base License the Lifecycle License (which can be ordered for 12, 24 or 36 months).
The Lifycycle License is also based on the number of managed devices. In your case 50 devices. So you have that License - congratulations!
Otherwise order the Lifecycle License for 50 devices (L-N-PI12-50-M). This generates CON-PSUU-PI12LF50 for 12 months, list price 414,81$. Then Upgrade from 1.1 to 1.2, patch the system and upgrade to 1.3.
Have fun,
Chris

Logs from Cisco Prime

Similar Messages

Maybe you are looking for