Solved: Prime Infrastructure 1.2 Syslog

Carlos Morais · ‎10-29-2012

Hi,

We are currently working on a solution comprising Cisco Prime Infrastructure 1.2 and we can't understand if Prime Infrastructure can work as a syslog collector, since we can't get it to show us any syslog messages sent from the network devices in its the Alarms & Events section. Is this a normal behavior? Is it necessary to use a remote syslog collector on another machine?

Best regards!

Marvin Rhoads · ‎02-03-2014

You can edit the file in vi if you're handy with that text editor. I find it much easier to just create a new file like aijaz described above (copied below here) using your favorite local text editor (I use notepad++ in Windows) and name it syslog_sev_filter.xml.

Once you have that, copy it onto the PI server using ftp. You can then drop into the shell rename the current file syslog_sev_filter.xml.old and then copy the new syslog_sev_filter.xml file from your ftp repository to the /opt/CSCOlumos/conf/ directory.

Follow all that with popping back up out of the shell and do "ncs stop" followed with "ncs start" to restart the server and you should now be getting all severity syslog messages in your application.

/opt/CSCOlumos/conf/syslog_sev_filter.xml file (Bold lines have been added here):

View solution in original post

mmisonne · ‎01-17-2013

Hello

I have the same problem. ( with Prime 1.2) .

Is there any setup for this ?

Regards

Michel

Michel Hegeraat · ‎01-17-2013

According to this doc similar functionality is there, in the LMS and the NCS(PI) part.

http://www.cisco.com/en/US/partner/prod/collateral/netmgtsw/ps6504/ps6528/ps12239/app_note_c27-716230.html

Cheers,

Michel

Carlos Morais · ‎01-24-2013

Yes, in fact there is and it's working for us now. We've been able to solve the proble exposed above... it was only related to the logging level in the switch.

Best regards,

Carlos Morais

Kyujin Choi · ‎02-18-2013

I tried user level 15 like below, and shut down an interface, but Prime can't receive any syslog

logging console informational

logging monitor informational

logging facility local0

logging source-interface Vlan1

logging 192.168.7.77

SW2(config-if)#

username cisco privilege 15 password 0 cisco

username test password 0 cisco

This is what I understand...

Prime has syslog built-in service. If I go to events, I can see some informational, critical, error message from events panel, however syslogs panel doesn't show up any thing even if switch generates syslog.

Do you have any idea?

Carlos Morais · ‎02-20-2013

Hi,

I guess it is good that you don't receive any messages. Try to change the following command:

logging facility local0 to logging facility local7

Best regards.

Kyujin Choi · ‎02-20-2013

I found answer. Anyway thanks.

Currently PI 1.2 does not have full syslog reporting capability. That is an enhancement scheduled for a future release of NCS, under the enhancement bug CSCud66666.

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCud66666

danielkuhl · ‎04-23-2013

Found same bug using PI version 1.2 (1.2.1.012).

PI shows only some syslog messages from ASA for a period of time, but nothing else. And now I got no further syslog messages from ASA anymore, while I changed nothing on PI and ASA.

JERRI - · ‎07-04-2013

Hi Kyujin,

How about PI 1.3, did it support for syslog collection??

Thanks,

Jerri

trong.cuong.k50.hut · ‎08-21-2013

My Syslog Server on Cisci PI 1.3 is not working.

Someone please give me the advise.

Thanks

Marvin Rhoads · ‎08-21-2013

As noted above, PI does not have full syslog server reportng capabilities. That applies to both PI 1.2 and 1.3.

mmisonne · ‎09-04-2013

Prime 2.0 , (available now) is integrating a real syslog server.

danielkuhl · ‎09-05-2013

I hope Prime 2.0 will work better with all services which were integrated. I am not happy with the entire Prime (only using version 1.2.1.012) at this time.

timo.voelker · ‎09-05-2013

Hi,

we are using Prime 2.0 now, but the syslog problem remains. It seems that cisco did more bug fixing (which was definitely necessary) than implementing new functions to PI 2.0.

If I understand the More Info section in this bug description

https://tools.cisco.com/bugsearch/bug/CSCud66666

correctly, then we have to wait für PI 2.1 for a working syslog server.

aijazbeigh · ‎12-13-2013

Hi,

Syslog is working on PI2.0. by default Prime only accepts the severity 0 and 1. you will need to modify a file in PI 2.0 to allow prime to accept Syslog messages.

change following file

/opt/CSCOlumos/conf/syslog_sev_filter.xml file (Bold lines have been added here):

Regards

Aijaz

Please rate helpful posts...