Ciscoworks 3.1 syslog.log filtering

[Erik Molnar]

Hello Cisco community!

I would like to ask a question about syslog.log file in Ciscoworks 3.1.

I was able to forward my syslog messages to another syslog server ( with a syslog-agent forwarding the content of the syslog.log file ), but in the syslog.log file there is other syslog messages that i don't want to forward ( about processes and other things ). I only want to forward the syslog messages that the devices's sent to CW.

Can i somehow filter out in Ciscoworks the messages that i don't want to forward?

Thanks for help.

[yjdabear · Accepted solution]

I think the RME syslog filters only apply to what/how CiscoWorks reads from syslog.log into its own database. They don't control what goes into or gets forwarded out of the raw syslog.log itself. What you could do is to 1) set up a separate log file with a dedicated logging facility+level in syslog.conf for devices whose logs you do want to forward, 2) configure all your devices to log to that facility+level, 3) point the forwarding agent & CiscoWorks LMS to read from the separate log file.

[Erik Molnar]

Thanks for the fast reply!

I guessed that it will be the best to create a separate file where syslog will send the messages i want to, but i could not find the syslog.conf on my ciscoworks installation ( Windows ).

Can you help me?

[yjdabear]

You mean you can't find the syslog.log file? A trip to regedit may be in order:

http://www.cisco.com/en/US/products/sw/cscowork/ps2073/products_tech_note09186a00800a7275.shtml

On a Windows System, the location is defined in the registry [ which can be viewed from regedit]:

\system\currentControlSet\Services\CRMlog\Parameters

LogFile = "CSCOpx\log\syslog.log"