LMS4.1 Syslog

[vaughancahill]

Hi,

I have setup about 16 devices to syslog to LMS4.1 Vmware eval... but I am not recieving any messages at all. I know these devices are generating syslogs to another system but lms doesn't show anything under monitoring / syslog_info.

Is there anything special I need to do to setup LMS4.1 to recieve syslog's sent directly to its IP. .e.g. not using an external syslog server but using LMS.

logging lms4.1server

...

[Joe Clarke]

You need to make sure UDP port 514 is open between device and server and that the CiscoWorks Syslog service is running.  If you have configured any syslog filters, make sure you are choosing to drop/keep the correct message types.

[vaughancahill]

I can see the softappliance is listing on tcp/udp 514, so I assume that means the syslog service is running. There are also no firewalls in between....

logging configured on devices as..

logging facility local4

logging source-interface Vlan1

logging 10.1.7.27

logging 10.1.2.174

I have tried disabling/enabling differnt filters to no avail..

any other ideas?

[vaughancahill]

I've changed logging level to local7. now I can see in the syslog settings 30 syslog messages forwarded, but nothing shows in the event monitor

[Joe Clarke]

I found a bug in the way timezone offsets are handled with syslog in LMS 4.1.  If you open a TAC service request by clicking on the Open Service Request link in this action panel of this thread, your TAC engineer can contact me for a patch.

[vaughancahill]

Does this still apply when its an evaluation version? I assume tac won't be interested with out a lms contract..

[Joe Clarke]

Without a contract, you will not be able to open a Service Request.  The bug is such that syslogs will not be seen for a time period equal to your offset from GMT.  I will push the patch, and hopefully it will be published to Cisco.com for general availability.

[vaughancahill]

Thanks Joseph, I'll wait and see.

[Joe Clarke]

For tracking purposes, the bug is CSCts11531.