SSM Smart Software Manager On-Prem - Syslog events

[jvujcich]

I'm trying to get the On-Prem server to send a failed syncronisation syslog message to our customer monitoring platform.

It is important for us (as a monitoring facility) to know when the on-Prem server fails to syncronise to the Cisco SSM Licensing portal.

However, I can not get the on-prem server to send this particular message to the syslog server.

Some messages are sent out , (e.g. Licensing notices and errors) .

Please help me.

[jvujcich]

Hi there, 

I am still having problems with most syslog meaasages not being sent to our syslog servers.

From a TCP dump, I see that the messages do not even leave the ISE nodes.

These following messages do get sent:

CISE_System_Statistics: 1247

CISE_AD_Connector: 36

CISE_MONITORING_DATA_PURGE_AUDIT: 6

CISE_TACACS_Accounting:  CISE_TACACS_Diagnostics:

These ones do not get sent:

High Memory, Disk, CPU, and authentication alerts.

Please help, This is getting worrying because the authentication servers for a whole company is going un-monitored at the moment.

[jvujcich]

Oops, sorry, forget about the last reply/update. I copy pasted info from another similar issue I'm having with ISE.

The issue i am working on, in this post, is with the syslog messages comming out of a Smart Software Manager (Satellite) On-Prem server .

The syslog messages i do get are:

user.info; Jun 29 03:09:28 pdssma01.trl ssms-production: I, [2020-06-29T03:09:28.426624 #82] INFO -- : The Virtual Account "Default" reported a shortage of 4 "C9200L DNA Essentials, 24-port Term license" licenses..

user.alert; Jun 29 03:15:56 pdssma01.trl ssms-production: E, [2020-06-29T03:15:56.049369 #82] ERROR -- : translation missing: en.event.event.entitlements_insufficient on account..

Which is great, but I also want alerts and errors to do with CPU, Memory, Disk issues and more importantly syncronization to the Cisco portal issues.

There are no syslog options in the GUI, But I'm wondering if something can be done via the CLI to enable alerts ?

Cheers

John