What is the HA_EM-6-LOG message for?

[kaghytayu2]

Hi all,

First and foremost apologies if this doesn''t belong here.

But I was wondering what the HA_EM-6-LOG: catchall XXXX messages are for on a 9800 WLC.

I''ve been trying to get messages over to Graylog but it seems the current setup contains no messages that are being sent because of some catchall.

Would you be able to enlighten me, or perhaps point me in the right direction as of to get logging to Graylog (message types).

Thanks in advance,

Eloy Lion

[marce1000]

 - Is the controller managed by DNAC ? If so this might be some provisioning setting  to send all the logs to DNAC (only) , 

 M.

[Rich R]

From a Google search it looks like Graylog is a SIEM solution so they probably want you to send syslogs to the Graylog server.
First you need to know what logs they want and then you configure syslog as per the config guide:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/m_syslog_server.html#t_configuring_syslog_server_for_the_controller_gui.xml
CLI allows more granular configuration and filters than the GUI.

[DJW487]

Did you have TAC help at all with that WLC?
When I had some Catalyst Center provisioning issues with a switch, they got me to put this on:

event manager applet catchall
event cli pattern ".*" sync no skip no
action 1 syslog msg "$_cli_msg"

And it shows in the logs exactly what is happening behind the scenes when catalyst center was provisioning a switch, not just a generic message.

Is that applet on your WLC?

[kaghytayu2]

I've been able to get our WLC to log to Graylog after some trial and error, but it's just these messages now and it seems to be okay, but I'd need to dig deeper into getting AP logging to Graylog.
Although me adding those logs, might slow down the Graylog cluster

[Rich R]

AP syslog is configured in the AP join profile:

ap profile default-ap-profile
 syslog facility <local5>
 syslog host a.b.c.d
 syslog level <debugging>
Configure facility and level according to your requirements.