VTY events

[rafiek.buffkins]

Hi,

How would I go about to extract vty login router messages from the syslog to an event on DFM or generate them in a syslog report.

I have routers configured to send their logs to syslog server but unable to view them in ciscoworks.

I'm using LMS 3.1

Regards

Rafiek

[Joe Clarke]

All syslog messages are stored in the RME database once processed. Assuming the messages are making it to the RME server, then you should be able to run a syslog report under RME > Reports > Report Generator, and see the desired messages.

[rafiek.buffkins]

The syslog.log file is being populated with vty login messages. I have message filter setup to track telnet, tty, and * messages. Yet when I generate a report, I dont see any login or vty data.

But is there a way to turn these messages into an event or alert like in the DFM? For instance like the critical messages shown in the alert portlet in the DFM?

[Joe Clarke]

No, you cannot turn syslog messages into DFM events. However, you can configure RME syslog automated actions to send you email when certain syslog messages arrive. You can also view the most critical syslog messages by looking at the RME Syslog Alerts portlet.

As for why you're not seeing the messages, please post a sample of the messages showing up in the syslog log file as well as a screenshot showing your filter settings.

[rafiek.buffkins]

Hi,

Thanks. I've set up the email notification.

Please see attached and the sample vty log in the syslog.log.

40w5d: %SYS-5-CONFIG_I: Configured from console by stephena on vty0

I would like to see "stephena" in a report somewhere. Is this possible?

Regards

Rafiek

[Joe Clarke]

You may already be seeing this in your Change Audit reports since this is a config change message.

As for the syslog reports, post a screenshot of the RME > Tools > Syslog > Syslog Collector Status screen as well as the NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/filters.dat

file.