Can Syslog Analyzer be redirected to another port ?

[georg.tresselt]

Is it possible to have the RME syslog analyzer listen on another port different from UDP 514 ?

[pradeepde]

For Solaris, it is not possible as the Operation system itself is maintaining the Syslog operation. In Windows, Ciscoworks is running a service for the collection. You can also try using Remote Syslog Analyzer Collector.

[georg.tresselt]

Thanks for your suggestion. It is in fact a Windows installation. The problem is that we want to monitor syslog messages coming from CSS11050 and VPN3005, too. Currently, these are not supported by Syslog Analyzer.

So, our idea was to install something like the Kiwi-Syslog tool, but have it redirect everything to the RME syslog analyzer. Such that we could see the syslog messages from CSS11050 and VPN3005 in the Kiwi tool and all the rest in RME.

Problem is of course that the two tools would clash on port UDP/514. That's why I thought one should redirect RME syslog analyzer to another port. (Just like you do with DFM when their is another tool listening on UDP/162 for SNMP traps.)

[paddyxdoyle]

George,

If you can control the facility level of these two devices then you should be able to create an additional syslog for them, however i don't think you can pull this into Cisco Works.

You can certainly have additional syslogs for certain devices (as i mentioned) on a Solaris box but i can't vouch for Windows as i am not familiar with syslogging on Windows.

Hower, have a look here and it might give you some ideas:

http://www.cisco.com/en/US/products/sw/cscowork/ps2073/products_tech_note09186a00800a6a8d.shtml

example on solaris:

Cisco works uses local.7 to log to /var/log/syslog_info

You could configure your *other* devices to log to local.6 and have any such messages logged to /var/log/syslog_info_2

That is, of course, if you can change the logging facility of these devices.

HTH

Paddy