Cascaded RME syslog

[shane.finn]

We have several CW2K servers running different subsets of the CW2K suite. Rather than have all of our hundreds of ends devices sending identical SYSLOGs to multiple CW2K SYSLOG servers over our WAN, we are exploring getting all devices to send to one CW2K SYSLOG server, and getting that server to send to all other CW2K servers. This would reduce our WAN traffic and let the servers which are all on the same LAN segment cascade the SYSLOG stuff.

How would we cascade SYSLOG like this from one CW2K instance to another?

[rmushtaq]

CW2K is not degined to work in this way currently.

[shane.finn]

I certainly understand it is not possible out of the box. Could it be done with a SYSLOG automated action?

[bjellig]

If you are running CW2k on Solaris, here's how to configure it to collect logs AND forward them to another server:

Add lines to the /etc/syslog.conf file (for all of the facilities/severities listed under the cisco-works comment in the file):

local7.info /var/log/syslog_info #<-this line is there already

local7.info @a.b.c.d #<-add this one where a.b.c.d is the remote cw2k server IP.

Restart the syslog collector.

I'm not certain how (or if) you can modify the CW2k syslog service on Windows to accomplish the same thing.

If you want to configure a totally different box to act as the syslog proxy:

For *nix, configure /etc/syslog.conf as you would for Solaris above. You don't need the line to log to a local file. (refer to the man pages for details on how to enable the syslogd to run automatically for the particular flavor of *nix)

For windows, you can use the free Kiwi Syslog daemon, (http://www.kiwisyslog.com) which has the option of forwarding the messages to another syslog host.

[shane.finn]

Thanks.

We run Windows so I will investigate runnign an intermediate syslog server like Kiwi and redistribute from there.