Collecting logs from Cisco Prime Infrastructure

[nimz12345]

Hi ,

I am currently working in integrating  Cisco Prime Infrastruture with the siem tool Qradar.

Can any one help me out in below issues:

1)How and where is the log stored in Cisco Prime.?

2)Does the logs contains the logs of the devices that Cisco Prime manages?

3)Is there any way to sent out the logs from Cisco Prime to a third party device.?

[AFROJ AHMAD · Accepted solution]

Hi,

1)How and where is the log stored in Cisco Prime.?

/opt/CSCOlumnos/logs

2)Does the logs contains the logs of the devices that Cisco Prime manages?

AFAIK,

In the prime infrastructure Syslogs are directly read from udp port 514 and then filtered
, the non SEV1 and SEV2 syslogs will be dropped and will not be entered into db . The
syslog messages will not be saved into log files .

Till now PI support only SEV 0,1 and 2 syslog.

3)Is there any way to sent out the logs from Cisco Prime to a third party device.?

unfortunately , this feature is not there in PI so far.

Thanks-

Afroz

***Ratings Encourages Contributors ****

[nimz12345]

Hi Afroz,

Can you please tell me if the logs in the location"/opt/CSCOlumnos/logs" contains the logs of the devices it manages?

[AFROJ AHMAD]

Hi ,

No ,these logs does not contain logs from the devices , these logs are the logs respective to inventory ,config archive etc..

Thanks-

Afroz

*****Ratings Encourages Contributors ****

[nimz12345]

Hi Afroz,

Thanks fro the information.

I have read that Prime Infrastructure logs all error, informational, and trace messages generated by all devices that are managed by Prime Infrastructure.Do you know where these  logs are saved?

[AFROJ AHMAD]

These logs are referring to same location shared before

/opt/CSCOlumnos/logs

Thanks-

Afroz