Syslog Automatic Actions on Solaris

[sbanyas]

Problem

From within CiscoWorks, we are able to run "command-line" actions based on identified syslog messages. Currently I am attempting to form a SNMP trap based on information passed from the CiscoWorks utility into a perl script. BUT, I am hitting the command-line 255 character limitation on some of the syslog messages, thus my "automatic action" is failing.

SYNTAX CONSTRUCT

/opt/CSCOpx/bin/perl /opt/CSCOpx/contrib/trapgen.pl $D <facility> <severity> <mnemonic> $M

where

$D = fully qualified device name from which the syslog message generated

$M = full text of actual syslog message

The $M variable can contain any number of characters, based upon what is contained in the actual syslog message.

Do you know of any way I would be able to work around this?

TIA for any ideas/help.

Scott

[oansari]

Scott,

could you write a wrapper script which only takes in $D and $M, and passes that into trapgen.pl.

currently you are passing 52+ chars already on the CLI before passing a single argument.

/opt/CSCOpx/contrib/trapwrap.pl $D XX $M

normally \ can be used to reset the 255 char limitation per line in regular shells like:

rtp-cse-205_oansari-> echo "this is a \

more> test"

this is a test

but I can dont see how we could use it here unless we could escape a in the automated action entry.

Can you share one of the longer "$M"'s ?

Omer

[sbanyas]

Hello Omer.

Thanks for looking into this. The following is one syslog example where I am running into problems.

Jul 21 23:04:24 dbksd400601m1esw01.dm1.stipn.com 14: Jul 22 04:04:23: %C4K_SYSMAN-3-LINECARDDIAGSFAILED: Module in slot 4 failed online diagno

stics. Please use 'show diagnostics online module 4' command for details.

Thanks for any assistance which you may give.

Scott

[oansari]

Scott,

I see the predicament. This is a limitation with sh (the underlying shell that cw2k uses)

csh does not have this problem (chars should be able to go to 2048) however all command line options you would provide would be run under "sh".

Thus, the only suggestion we have for now is to modify the CLI command as suggested earlier to conserve as many characters as possible for the $M. We understand that this may not work for all log messages.

The solution would be perhaps to have a POST -type mechanism for this CLI option (instead of a GET - type operation we have right now) but that would require code change.

Please file a PERS request with the help of your account team so we can get this enhancement in.

thanks

Omer