Prime Infrastructure 1.2 Syslog

[Carlos Morais]

Hi,

We are currently working on a solution comprising Cisco Prime Infrastructure 1.2 and we can't understand if Prime Infrastructure can work as a syslog collector, since we can't get it to show us any syslog messages sent from the network devices in its the Alarms & Events section. Is this a normal behavior? Is it necessary to use a remote syslog collector on another machine?

Best regards!

[ajc]

Hi Aijaz,

Thanks a lot for you note regarding the logs. However, I need your orientation regarding the following:

I do not remember the root patch password in order to get the ADE# prompt and check the file. Do I have to create a bootable DVD with the ISO and then apply a password recovery???. 

If I am not wrong, the ncs password root password VALUE only applies for the GUI Access to the box. I changed this one and tried again but it does not work.

tdsbncs01/admin# root
Enter root patch password : 
% Error : invalid root patch password

thanks

[Dwayne Phills]

This is a pretty big deal.  We will not function without a viable syslog solution.  Looks like we want be going Prime anytime soon.  Have to stick with Solarwinds.  That sucks.

[aijazbeigh]

Hi,

Syslog is working on  PI2.0. by default Prime only accepts the severity 0 and 1. you will need  to modify a file in PI 2.0 to allow prime to accept Syslog messages.

change following file

/opt/CSCOlumos/conf/syslog_sev_filter.xml file (Bold lines have been added here):

Regards

Aijaz

Please rate helpful posts...

[hensleeds]

Hi Aijaz,

On you modified the xml file to inlude the additional severity levels were you then able to see those as filter options through the GUI?

Regards,

Damon

[aijazbeigh]

Hi,

I was not getting anything earlier on the syslog page but once the change done. I can see all syslog and can do filter.

like below

Hope this helps

Regards

Aijaz

Please rate helpful posts

[hensleeds]

Thanks for the helpful information Aijaz.

[aijazbeigh]

You are welcome mate.....

[Marvin Rhoads]

Great find. +5

How did you determine this needed to be done? I would hope this is exposed via the GUI in the future.

I just tested on one of my installations and verified it now receives informational syslog entries.

[aijazbeigh]

Hi Marvin,

We had logged case with Cisco for this and finally after few days of troubleshooting it came to surface that there is filter in Prime to drop anything else apart from 0,1,2. this is there to keep Prime database low.

Regards

Aijaz

[Marvin Rhoads]

Cool thanks.

You'd think they could have just built in the logrot functions that are tried and true in LMS.

[aijazbeigh]

Hi,

You can consider Prime as baby. As per them it is still growing. One of the worst problems I have with Prie is reporting. as with any normal toll you will have tx/rx utilization reports generated in graphical form..

But with prime i have to take screen shot of dashlet for this kind of reporting. And when asked if it on roadmap I have been asked to raise new request for new feature.

Regards

Aijaz

[i.va]

I have a PI2.0 virtual appliance. How/where do I edit the abovementioned file exaclty?

[Marvin Rhoads · Accepted solution]

You can edit the file in vi if you're handy with that text editor. I find it much easier to just create a new file like aijaz described above (copied below here) using your favorite local text editor (I use notepad++ in Windows) and name it syslog_sev_filter.xml.

Once you have that, copy it onto the PI server using ftp. You can then drop into the shell rename the current file syslog_sev_filter.xml.old and then copy the new syslog_sev_filter.xml file from your ftp repository to the /opt/CSCOlumos/conf/ directory.

Follow all that with popping back up out of the shell and do "ncs stop" followed with "ncs start" to restart the server and you should now be getting all severity syslog messages in your application.

/opt/CSCOlumos/conf/syslog_sev_filter.xml file (Bold lines have been added here):

[jonathanrosas]

sorry but I do not see the bold lines have been added there, what are those bold lines?

[Marvin Rhoads]

One of the CSC site upgrades stripped out that content. Here is what the modified file should look like:

ade # cat /opt/CSCOlumos/conf/syslog_sev_filter.xml

<expression op='OR'>

        <!-- Error -->
        <condition field='severity' op='EQUALS' value='0' />
        <condition field='severity' op='EQUALS' value='1' />
        <condition field='severity' op='EQUALS' value='2' />
        <condition field='severity' op='EQUALS' value='3' />
        <condition field='severity' op='EQUALS' value='4' />
        <condition field='severity' op='EQUALS' value='5' />
        <condition field='severity' op='EQUALS' value='6' />
        <condition field='severity' op='EQUALS' value='7' />
</expression>
       
ade #