About Martin Ermel

Martin Ermel · ‎12-06-2018

just in case someone has the same problem... - this could be the reason... the origin-id is prepend to syslog messages sent to REMOTE hosts, so it will never show up on a console or monitor session. from the Usage Guidlines: [...] The origin identifier is added to the beginning of all system logging (syslog) messages sent to remote hosts. The identifier can be the hostname, the IP address, the IPv6 address, or any text that you specify. The origin identifier is not added to messages sent to local destinations (the console, monitor, or buffer). [...] https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/command/esm-cr-book/esm-cr-a1.html#wp3523355547 also on the syslog-server side, there is the possibility, that this information is cut-off after the message has been processed (parsed and filtered)

Martin Ermel · ‎01-09-2016

Joe, that did the trick - thanks a lot !

Martin Ermel · ‎01-07-2016

I am trying to write an EEM applet that reacts on a certain syslog message and writes the status of an alarm-contact (which is part of the Cisco IE4000) into a file. Later a second EEM applet shall read from that file and based on the content execute some commands …. or not. It seems my problem is the "file descriptor" part but I cannot find any documentation that describes in detail how to set and use the file descriptor.. This is what I have: event manager applet Contact_2 event syslog pattern "PLATFORM_ENV-1-EXTERNAL_ALARM_CONTACT_CLEAR: Alarm cleared: external alarm contact 2" action 100 cli command "enable" action 200 file open $fh flash:Contact2_stat.txt w action 210 file write $fh "OPEN" action 220 file close $fh action 300 cli command "end" I have also defined these event manager environment variables: event manger environment $fh flash:/Contact2_stat.txt event manger environment fh flash:/Contact2_stat.txt The error I get is the following (complete debug is attached) […] Mar 30 10:14:45.423: %HA_EM-7-FMPD_FILE_WRITE: fh_stmt_file: failed to write to fd flash:/Contact2_stat.txt : invalid file descriptor Mar 30 10:14:45.423: %HA_EM-3-FMPD_ERROR: Error executing applet Contact_2 statement 210 […] The file exists in flash: but it is empty. What could be the issue ?

Martin Ermel · ‎01-08-2015

Thanks, yes, this makes it clearer. regards, Martin

Martin Ermel · ‎01-08-2015

Leo, I think you are not correct ... ( to be truth - I hope it ;- ) ) in PI 2.2 the Cat 3550 is listed under the supported devices whereas the Cat 2950, 2955 are not: http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/2-2/release/notes/cpi_rn.html#pgfId-43885 But the latter are listed as being supported in PI 2.1 (while the Cat 3550 is not...) http://www.cisco.com/c/dam/en/us/td/docs/net_mgmt/prime/infrastructure/2-1/supported/devices/pi21-supported-devices-list.xlsx?mdfid=284540974 So hopefully it is just a matter of time to get them ALL on the list of supported devices for the current version of PI 2.2 ... I just saw that for Prime Network (Management SW for Service Providers) they even have Cat 3500XL on the list of supported devices... (but I do not know for which type of management they do support these devives, e.g. config, alarming,etc) http://www.cisco.com/c/dam/en/us/td/docs/net_mgmt/prime/network/4-2/supported/vnes/CiscoPrimeNetwork-4-2-SupportedCiscoVNEs.pdf

Martin Ermel · ‎01-08-2015

Vignesh, I do not really get the difference between Prime Network and Prime Infrastructure from your explanation. If I mangage all individual elements of a network I also manage the complete network from end to end so where is the difference ? Is there a difference in functionallity (config management, alarming, etc.)? At least it seems to me that Prime Network still supports legacy devices where Prime Infra only supports latest devices (even not Cat 2970, 3550) regards, Martin

Martin Ermel · ‎12-04-2014

I am not sure if I really understand your issue .... Are you wondering that the first interface does have an ifIndex of 49 (and not 1) ? If you have 2 non-modular switches of the same hw-type and the same software, the ifIndex should be the same for identical physical interfaces on both devices. But the ifIndex (1.3.6.1.2.1.2.2.1.1) itself is nothing else than a numeration. The meaning of each ifIndex can be found by walking the ifTable (1.3.6.1.2.1.2.2.1).Per definition, it should start with "1" - but it needn't to. Sometimes the vendors are using a schema like ifIndex 1- 48 for FastEthernet, 49-99 GigInterface, >100 TenGig (as a very simple example...) The ifIndex can be reassigned with every reboot of a device and can be different from the last one. For non-modular switches this is (typically) not the case, but for modular switches this happens. Imaging a switch with modules in slot 1,2 and 4 and that gets a new module in slot 3 while it is running. After a reboot it is highly possible that the mapping of ifIndices to interface have changed.

Martin Ermel · ‎10-17-2014

Could you please also share the output of the following 2 commands in a DOS box (with admin privileges) fsutil volume diskfree d: fsutil volume diskfree E:

Martin Ermel · ‎10-17-2014

just go and configure on a per interface basis "no logging event link-status" on those interfaces from which you do NOT want to receive these type of messages (i.e. end-user ports)

Martin Ermel · ‎10-17-2014

On what platform is LMS running ? Windows or Linux? What is the path of your backup directory ? You can see it under Admin > System > Backup Also please share the dbbackup.log. You can find it here... for Linux: /var/adm/CSCOpx/log/dbbackup.log for Windows: NMSROOT\log\dbbackup.log with NMSROOT being your Installation directory (e.g. C:\Program Files\CSCOpx)

Martin Ermel · ‎10-24-2013

it seems not to be on the road-map according to the functional /feature comparison between LMS and PI 2.0: http://www.cisco.com/en/US/partner/prod/collateral/netmgtsw/ps6504/ps6528/ps12239/guide_c07-729089.html ...and I doubt it will come (quickly) because config management has a lot of pitfalls and Cisco has a lot to do to get around all of them with their own devices.. However, Inventory Management for third party devices is on the road-map older version of the document (feature comparison PI 1.2 - LMS 4.2) can be found here: http://www.cisco.com/en/US/partner/prod/collateral/netmgtsw/ps6504/ps6528/ps12239/app_note_c27-716230.html

Martin Ermel · ‎10-07-2013

it is not possible to compile or "put" a MIB file into a Cisco switch. The supported MIBs are compiled within the IOS. Have a look here to see which IOS supports which MIBs: http://tools.cisco.com/ITDIT/MIBS/MainServlet http://tools.cisco.com/ITDIT/MIBS/servlet/index

Martin Ermel · ‎09-13-2013

you only mention the sending of traps so I assumed it to happen on the device side. What you need is some kind of correlation engine and this depends on the managment software you are using. Neiter PI nor LMS do have a correlation engine but if you could use syslogs instead of traps and you are on LMS then there is the posibility to do some scripting with automatic actions. If you are using other NMS software like Solarwinds NPM it is possible with the "Advanced Alerts" feature. Someone told me - in the long run - PI should get some basic correlation as well.

Martin Ermel · ‎09-13-2013

for failed login attempts to the switches, configure the following in global config mode: login on-sucess log login on-failure log and you should get syslog messages on succesfull and failed login attempts. Additionaly, you can define an automatic action on this specific syslog message to send you and e-mail based on this message

Martin Ermel · ‎09-13-2013

just a quick note regarding the syslogs.. It seems that you are sending syslogs with a facility of "local0" which could be the cause of your problem. Cisco devices typically send syslogs with a facility of "local7" and I assume the syslog receiver of Cisco PI filters on the facility. AFAIK, only some Cisco security devices use a facility other then local7.

Date Registered	‎11-16-2001 09:42 AM
Date Last Visited	‎12-12-2018 08:33 PM
Total Messages Posted	1,561
Total Helpful Votes Received	928

Re: Logging Origin-ID Problem

Joe, that did the trick -

eem action file -no write to file poss...

Thanks, yes, this makes it

Leo,I think you are not

Vignesh,I do not really get

I am not sure if I really

Could you please also share

just go and configure on a

On what platform is LMS

Cisco Prime Infrastructure 2.0 --> Thir...

procedure of putting MIB in cisco switc...

2811 SNMP traps

Re: Invalid credentials report LMS

Prime Infrastructure (2.0) utilization ...