Prime Infrastructure 3.9 Syslog Severity Debug Messages

[rick505d3]

Hi,

Configured an IOS device to send syslog severity debugging and above messages to Prime Infrastructure (3.9) which is acting as a syslog collector.

    logging trap debugging
    logging host 10.10.10.10

However, I only see 'Information' and above level messages in Prime (Monitor / Monitoring Tools / Syslog Viewer: Historic).

The 'show logging' on the switch show the correct log level, and the debug level buffered or console messages. Also, packet capture on the switch shows debug related messages (traps) are going out towards Prime.

    Trap logging: level debugging, 4754749 message lines logged
        ....
        Logging to 10.10.10.10  (udp port 514, audit disabled,
              link up),
              16606 message lines logged,
              0 message lines rate-limited,
              0 message lines dropped-by-MD,
              xml disabled, sequence number disabled
              filtering disabled

The Prime syslog config file accessible through CLI shell interface does cover all severity levels:

	ade # pwd
		/opt/CSCOlumos/conf
	ade # cat syslog_sev_filter.xml
		<condition field='severity' op='IN' value='0,1,2,3,4,5,6,7' />

How to get Prime to show Debug level syslog messages?

Thanks,

Rick.

[balaji.bandi]

Trap vs Facility

Have you configured Facility ?

logging facility local7

0- Emergency
1 – Alert
2 – Critical
3 – Error
4 – Warning
5 – Notification
6 – Informational
7 – Debugging

[rick505d3]

Thanks BB, 'logging facility local7' is default enabled on the router i.e. under 'show run all'.

Regards,

Rick.

[balaji.bandi]

on Prime you can see other Log level not debug Logs ? please claroify

clear the Logging counters and check, is the Logging server and device in same VLAN ? or any Firewall between ?

Do you have any Debug enabled which you can see Logs in the device ?

[rick505d3]

Debugs are enabled and debug logs show up on the router console as well as buffered (show logging). Packet capture on router interface facing Prime shows debug level syslog messages going out to udp 514. Prime GUI shows 'Information' and above level messages, but no debug messages are displayed. There is no firewall along the path.

Regards,

Rick.

[balaji.bandi]

I belive there is some Limitation with Prime i guess here :

Look at this thread:

https://community.cisco.com/t5/network-management/collecting-logs-from-cisco-prime-infrastructure/td-p/2584741

Not sure reading document PI 3.9 can do this, but not tested myself.