CIsco Prime 2.2 - syslog not working ?

[steffen.bodensohn]

Hello,

yesterday i configured our network to sent syslog messages to the Prime Infrastructure Server 2.2. 

After the configuration was done  i checked prime for received messages and it worked. 

Now it seems that Prime is not receiving any messages anymore ?!

Can someone help  to solve this situation ? 

Best regards,

Steffen

[Marvin Rhoads]

Did yo check to make sure your filter (dropdown box a the top right of syslog message view in PI) is not reverted to the default (message level 0,1,2)?

If it is set to all severity levels and your still are not seeing new messages, can you check with a tcpdump at the cli to see the incoming udp/514 messages are arriving?

[steffen.bodensohn]

Hello,

I always set the filter to "all". Also the syslog counter (upper right corner as well) does not increase.

for troubleshooting purpose i already stopped ncs and rebooted the server but it had no effect.

By checking with TCPDUMP it seems that syslog messages are constantly received:

---------------

ade # tcpsump port 514
sh: tcpsump: command not found
ade # tcpdump port 514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
14:37:07.537278 IP cn-sha-zho-s02.heraeus.com.55990 > DE-HAU-DC-PRIME.syslog: SYSLOG local7.notice, length: 104
14:37:07.904737 IP 10.102.28.98.54561 > DE-HAU-DC-PRIME.syslog: SYSLOG local7.notice, length: 124
14:37:09.892785 IP 10.102.28.98.54561 > DE-HAU-DC-PRIME.syslog: SYSLOG local7.notice, length: 122
14:37:20.112984 IP 172.26.96.103.52922 > DE-HAU-DC-PRIME.syslog: SYSLOG local7.warning, length: 164

[steffen.bodensohn]

Just in case anybody has the same problem. After testing a lot of things I installed patch pi221_Update_01_6.ubf  and now it seems to work. 

Best regards...

[Shaik Moinuddin]

Hi Steffen,

can i know the devices which sending syslogs are Prime managed devices or any device can send syslog to Prime???

your response will be appreciated...

thank you,

[Marvin Rhoads]

Any source can send syslog messages to Cisco Prime Infrastructure.

As long as they are well-formed syslog messages sent to PI's IP address on udp/514 they will be received and processed.

[Shaik Moinuddin]

thanks Marvin.

[Marvin Rhoads]

You're welcome. Please rate if it helped.