Syslog alert mails

[shabeersahib]

Hi All

Please assist, we had LMS3.1 installed and the Syslog was setup to mail the following message:

Syslog message generated from device 10.X.X.X: Mar 08 08:19:23 10.X.X.X 6439: 006554: *Mar 22 08:19:30.503: %RTD-1-LINK_FLAP: FastEthernet0/19 link down/up 5 times per min.

We upgraded to LMS3.2, and now its seems like we cannot get this Syslog Alerts mail to us.

The devices are still configured to sent this syslog messages to the the IP add of the CiscoWorks server.

Could someone please assist us as to how can we get this working again?

Many thanks

Shabeer

[Vinod Arya]

Hi Shabeer,

Did you upgraded to LMS 3.2 or did a fresh install?

These kind of messages are sent when you configure Automated Action on LMS. A fresh install might have removed that, you may want to check :

RME > Tools > Syslog > Automated Actions

And check if any user Automated action is configured (by default two AA are available for Configuration Archive and Invenotry).

Secongly, please check if the Syslog mechanism is working fine or not, by generating a 24 Hrs Syslog Report to see if that comes fine. If not, you have to t/shoot Syslog issue first and than AA.

[shabeersahib]

Hi Vinod

Thanks for the feedback, more specifically how is the automated action filter setup to email this specific syslog:

Syslog message generated from device 10.X.X.X: Mar 08 08:19:23 10.X.X.X 6439: 006554: *Mar 22 08:19:30.503: %RTD-1-LINK_FLAP: FastEthernet0/19 link down/up 5 times per min.

Other automated action emails are working and we getting syslog reports, we just need to get this specific one working.

Currently the Automated action filter is set up as;

Facility: RTD

Sub-facility: *

Level: *

Message: LINK_FLAP

notes, etc: empty

[Michel Hegeraat]

Try :

Facility: *

Sub-facility: *

Level: *

Message: *LINK_FLAP*

Cheers,

Michel

[Vinod Arya]

Hi Shabeer,

I guess Micheal mentioned it correct. Keep everything * and mention the message part should do the Job.

please see the LMS 3.2 User Guide for more details on AA:

http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_resource_manager_essentials/4.3/user/guide/syslog.html#wp1211314

-Thanks

Vinod

[shabeersahib]

Hi Guys

Thanks for the help, I have tried these settings and we still not getting the alerts mailed.

Attached is the screenshots of the settings, please advise on the next action can we take?

Many thanks

Shabeer

[Michel Hegeraat]

Put the *link_flap* or perhaps  *link up/down*  in the desciption part

Cheers,

Michel