Relation between DFM event and dev syslog

[Gongyuan Yao]

In LMS 3.2, DFM has 28 events to inform network administrators for any alerts. Also RME has syslog report. Looks like there are some relation between these two sets. Anyone can help me to give some brief summary for this relation?

As I noticed that DFM events have not included all of severity 0 and 1 syslog and not all of DFM events can be found in syslog. This is true, since DFM is using polling methods (most of them) to collect info. Syslog is sent by dev.  Does DFM also is doing some syslog analysis or totally not deal with dev ?

Thanks in advance.

gy

[Joe Clarke · Accepted solution]

Actually, there is no direct relation between the RME syslog reports and DFM.  As you pointed out, DFM is doing mostly polling to build its events and alerts while RME is looking purely at syslogs sent by the device.  On some occasions, DFM will detect a situation which also caused the device to send a syslog message (e.g. a switchport may send an err-disable message and DFM finds both a HighErrorRate event along with an OperationallyDown event for the same port).

Really, DFM and RME syslog reports are two complementary processes.  Combined, they can give a more complete picutre about what is happening on a given device during a device level event.

DFM does not process any syslog messages.  If can, however, send its events and alerts out as syslog messages to another syslog host (but not RME since RME would not understand those messages).  This is done via DFM > Notification Services.