Remote syslog configuration for UCS

[Amit Vyas]

Hello,

I am in process of setting up Remote Syslog for our UCS manager

I have done the configuration as per Cisco official document at http://www.cisco.com/en/US/products/ps10281/products_configuration_example09186a0080ae0f24.shtml

I would like to understand "Level" & "Facility" options in detail like what kind of messages apart from alerts UCSM will send to Syslong server

Kindly guide me where I can find the document related to this or any one from Cisco can help me on this.

Few weeks back we faced one of FI got rebooted unexpectedly and then it went to hung state and we were unable to find the root cause of this issue hence want to understand syslog in detail

Regards,

Amit Vyas

[Robert Burns]

Amit,

Have you had a look at the Fault and Error Message doc?

http://www.cisco.com/en/US/docs/unified_computing/ucs/ts/faults/reference/ErrMess.html

I've also attached a presentation that details the various logging levels.

Let me know if this is what you're looking for.

Regards,

Robert

[ericwill]

The "Level" denotes the minimum severity UCS Manager will send to the remote syslog server.  The facility denotes the remote facility in your remote syslog server you want UCS manager to send them to.  Here is an example syslog.conf file from a Linux server:

[root@serve retc]# cat syslog.conf

# Log all kernel messages to the console.

# Logging much else clutters up the screen.

#kern.*                                                                      /dev/console

# Log anything (except mail) of level info or higher.

# Don't log private authentication messages!

*.info;mail.none;authpriv.none;cron.none                    /var/log/messages

# The authpriv file has restricted access.

authpriv.*                                                            /var/log/secure

# Log all the mail messages in one place.

mail.*                                                                      -/var/log/maillog

# Log cron stuff

cron.*                                                                      /var/log/cron

# Everybody gets emergency messages

*.emerg                                                                      *

# Save news errors of level crit and higher in a special file.

uucp,news.crit                                                            /var/log/spooler

# Save boot messages also to boot.log

local7.*                                                            /var/log/boot.log

local5.*                                                /var/log/ucs.log

In this example I have configured UCS Manager to send syslog messages to facility "Local5", and as you can see above, I'm directing facility "Local5" on my remote syslog server to /var/log/ucs.log. 

I would highly recommend you check out the new Monitoring Cisco UCSM with Syslog guide here:

http://www.cisco.com/en/US/docs/unified_computing/ucs/sw/ucsm_syslog/b_Monitoring_Cisco_UCSM_Using_Syslog_chapter_01.html

If you choose to turn on audit or event logs from UCSM to be sent to syslog, they will all come in as informational messages.    

[asafayan]

Hi Eric,

I was also trying to dial in my  understanding of Facility and your comment above seems at odds with the "Facility" section from the document you refered to which I've copied here:

%UCSM

Facility

Refers to the message source. The message source is usually a hardware device, a protocol, or a module of the system software. Note   Facility is Cisco-specific and is only relevant within the message string. It is different from facility as defined in RFC 3164 for the syslog protocol. For messages originating from Cisco UCS Manager, the facility will always be %UCSM.

Your comment seemed to suggest that the Facility level was a function of what was configured on the target syslog server - whereas the above cut and paste from the Cisco document you referred to states that it is a function of the "message source". 

TIA,

Amir