Syslog vs. SNMP - Which should I use?

[glusk]

Hi all,

We presently use a syslog daemon to receive messages from routers throughout the enterprise. Recently, we have had several PVCs going up and down, and I can't seem to get the router to log the change in status to my syslog server.

I have seen several examples and recommendations regarding the use of SNMP to log PVC status changes. Does anyone have a recommendation on this? I'm sure I just don't have our configuration set correctly in the routers to receive the notification via syslog, but if SNMP is better, I would like to know.

Thanks,

Greg

[rmushtaq]

Syslog should also work. If you want to setup SNMP traps for the router, have a look at http://www.cisco.com/warp/public/477/SNMP/snmp_traps.html for the details and examples etc

[chsmith]

I would be interested in knowing how syslog will provide you this functionality since it is operating by default on 514 and trap receiver is on 162. I am working on getting this exact same information from a 7206 at this time and I have found that the snmp-server trap hostipaddr communityname frame-relay is generating a trap for the serial subinterfaces. The problem of course is there is only a limited amount of information that it gives you in the trap so you ahve ot be able ot cross reference data in some other way. It looks like we are going to get this to work by using CA Unicenter Service Desk. We will hold down on the PVC status changing as according to RFC1513 and then open a help desk ticket to perform the cross referencing functions. Let me know if you figure a way to get the syslog to get you more pertinent information.

[rmushtaq]

Is this what you're looking for?

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/122t/122t4/ftpvctrp.htm

[p-monahan]

I also use a syslog daemon to recieve messages from enterprise routers and am having difficulty getting a router to log frame relay sub-interface up and down status or pvc status. I even enabled the snmp in the syslog daemon and have the following on the router:

logging buffered 65536 debugging

logging trap debugging

logging facility local6

logging source-interface Loopback100

logging 10.2.2.5

logging 10.2.2.6

access-list 99 permit 10.2.2.0 0.0.0.255

snmp-server engineID local 00000009020000500D6D1800

snmp-server community public RO 99

snmp-server community private RW 99

snmp-server trap-source Loopback100

snmp-server enable traps snmp linkdown linkup

snmp-server enable traps casa

snmp-server enable traps isdn call-information

snmp-server enable traps isdn layer2

snmp-server enable traps channel

snmp-server enable traps hsrp

snmp-server enable traps config

snmp-server enable traps entity

snmp-server enable traps envmon

snmp-server enable traps bgp

snmp-server enable traps rsvp

snmp-server enable traps frame-relay

snmp-server enable traps rtr

snmp-server enable traps dlsw

snmp-server enable traps dial

snmp-server enable traps voice poor-qov

snmp-server host 10.2.2.5 private

snmp-server host 10.2.2.6 private

Any ideas! By the way all other types of interfaces such as ATM using OAM, BVI and P to P serial devices are reporting correctly.

[chsmith]

If you will notice the frame relay subinterface does not allow you to put the link status command on the actual subinterface. The command will work on the gloabl interface but it will not trigger the trap on a link status change. I am still looking for a way around this to. I am getting closer, but I am having to use some cros reference functions based on the message output to a database.