CSM Syslog service

[aadeoye]

Hello,

I need to configure my CSM 3.2.1 server to act as a syslog collector for my ASA firewalls. I noticed that installing CSM automatically installs the CiscoWorks syslog service but I have been unable to find where I can configure the service.

I have browsed through the docs but have not found a section that addresses this.

One of the main reasons I am trying to do this is that I want the syslog database to be on a different drive separate from my CSM installation.

Thanks in advance.

[Joe Clarke]

You can configure this in the Registry under HKLM\SYSTEM\CurrentControlSet\Services\crmlog\Parameters. After any changes, you'll need to restart the crmlog service.

[aadeoye]

Thanks very much.

How can I view the logs in real time?

[Joe Clarke]

We ship a program called logview that can be used to perform a running tail on any log file. Just run:

logview LOGFILE

From a DOS command line. Use Cntrl+Break to exit.

[aadeoye]

Is this program a separate download or bundled with CSM?

[Joe Clarke]

It's bundled with Common Services, and should be found under NMSROOT\bin.

[aadeoye]

Thanks, I found it. However, I get this error message:

C:\Program Files\CSCOpx\bin>logview

E:\CSM_Syslogs: Permission denied

It also appears like I can not specify any parameters with the logview command.

[Joe Clarke]

It looks like you have misconfigured the server. Please post the contents of the previously mentioned registry key.

Yes, you can specify parameters. Just specify the path to the file you want to view.

[aadeoye]

I suspected that was the issue. I just specified the drive instead of a path to the file itself.

Once I corrected this and launched LOGVIEW, it started showing me the syslog output.

If possible, I would also like to specify rotation of the syslog files on a daily or weekly basis. Is this possible?

[Joe Clarke]

You can rotate the logs based on size using the NMSROOT\bin\logrot.pl script. This script is documented in the Common Services online help. Search for logrot.

Once you have it configured the way you want, then schedule it to run whenever you want the logfiles to be rotated. You can schedule it using the Windows command schedule (i.e. AT).

[aadeoye]

Thanks. I'll try that.

How do I specify that logview shows me only the last 50 lines of the log file?

[Joe Clarke]

Logview is very simplistic. If you want a more powerful tail feature for Windows, consider using a tool like Tail for Win32 (http://tailforwin32.sourceforge.net/) or use the tail program as part of the Cygwin distribution.