Ciscoworks - Syslog Analysis

[jbautistaSM]

In regards to the syslog database repository in RME, Ciscoworks LMS v3.2, is there a way to push the collected syslog data to a 3rd party syslog analysis collector (SAC)? Is this even supported by Ciscoworks LMS v3.2?

[Marvin Rhoads]

I haven't done it but it should be easy enough to push your archived syslog.log flat file over. Until it is archived (via logrot.pl log rotation tool) it would be an open/locked file.

[jbautistaSM]

Yes, we push out the syslog.log file now. However, the reason why we're looking for an alternative is because the server application we intially set up to receive the syslog.log is no longer supporting this practice( the server application got upgraded). 

[Marvin Rhoads]

Since you already have CiscoWorks managing your devices, why not designate your SAC tool as an additional logging host for those end devices? The network traffic and device processing burden is minimal.