CiscoWorks: How to backup syslog in different drive?

[raza555]

I want to backup the syslogs RME->ADMIN->SYSLOG->Set Backup Policy in E drive but when I do it I am receiving a error message "CEDT0070: You cannot select a file under E:/. You can select a file only underC:/PROGRA~1\CSCOpx\files\rme\syslog."

Any help appreciated.

THANKYOU

I am using;

LMS 3.2

RME 4..3.1

[Fadi Twal · Accepted solution]

Here is a snapshot of the user guide

In the Server Side File Browser dialog box:

a. Specify the external directory.

The external directory must be under the syslog directory, or a sub-directory within the syslog directory. For example, $NMSROOT/files/rme/syslog/sysbackup.

The external directory cannot be outside the syslog directory. If you attempt to navigate outside the syslog directory, an error message appears.

so i guess you can't do it outside the syslog directory

http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_resource_manager_essentials/4.3/user/guide/syslog.html#wp1053164

but you can change the syslog.log file location if you wants.

you can do that by

shutdown dmgtd, and run NMSROOT\bin\perl 
NMSROOT\bin\syslogConf.pl, and select the appropriate menu option.

hope this helps.

[Michel Hegeraat]

Have you tried the log rotation facility in common services?

It allows for another drive for backup

Cheers,

Michel

[Fadi Twal · Accepted solution]

yes logrot also make a backup for the syslog.log

but it do that whenever the syslog exceed a certain size and for all the syslogs in the syslog.log

the backup policy will do backup for the syslog data that is trimmed from the database and will be moved to a flat file and not for the syslog.log

hope this clarifies the difference.

[Martin Ermel · Accepted solution]

Rizwan555,
Have you thought about if you really want to have these backups? I found them fairly useful and you need to have an eye on these backups yourself.

It is as Fadi said, you have a purge policy for the syslog messages configured and according to this policy the messages are delete from the syslog database and are not available in RME syslog reports anymore. When you configure syslog backup, these purged messages will be written to the backup file. If you later want some information from these files you have to use cli tools.
All syslog messages are available in the raw syslog file (windows: NMSROOT\log\syslog.log; solaris: /var/log/syslog_info) and you can maintain a backup of this file with logrot.pl. And if you run logrot.pl every 1st of the month you have a file for every month.
If you really need old syslogs, personally, I find it better to have the unfiltered source (syslog.log) instead or what was in the database and apply the appropriate filter or search strings according to what I need.

[raza555]

Thank you so much Fadi & Mermel for solutions. I have made the backups as explained. Set purge policy to 7 days.

1. Do the RME syslog reports also contain data from backup files made via log rotation as mermel explain the RME reports do not contain data from purged files.
2. My purge files are 11 gigabit, how to delete the unwanted files.
3. Please give me example of cli to search the purged syslog files or backup syslog files. e.g; search for logs for SWITCH1

Thanks alot again

[Martin Ermel · Accepted solution]

with a purge policy of 7 days you will see syslog messages of the last 7 days when you create a Syslog Report (RME > Reports > Report Generator => Select an Application: Syslog)

1) when a Syslog Report job runs, it will work with the data in the syslog database (in your case data of the last 7 days); When you schedule a syslog report job to run periodically, the result of this job will be stored along with the other job info and will not be purged.

2) if you mean the backup files under $NMSROOT/files/rme/syslog/sysbackup it is save to just delete the unwanted files - that is what I meant when I said you need to have an eye on these backup files yourself - LMS does not care about these files

3) when I install LMS on windows, I always install some tools in case of troubleshooting and to access text files.

    i) with vim (vi for windows) you can open the files an use regular expression for searching  [http://www.vim.org/download.php#pc]

        also it opens text files > 1GB (it take some time ;-), same does notepad++)

        you should be used with vi commands or read some docs before using it...

    ii) with UnxUtils you have the unix grep and egrep along with head and tail and many others [http://unxutils.sourceforge.net/]

    (just unzip it to something like C:\Program Files\UnxUtils and add the following to your PATH variable: "C:\Program Files\UnxUtils\usr\local\wbin" then you can use it like this:

    cd C:\Program Files\CSCOpx\files\rme\syslog\

    grep -n "SWITCH1" *             (# searches "SWITCH1" in all file in this dir; prints file-name:line-no:line for every match)

    grep -n "SWITCH1" file-name     (# searches "SWITCH1" in the file ); prints as before)

    grep --help                 (# shows the help for grep)

[raza555]

THANKYOU very much for such a detailed solution.

It has answered all my queries.