cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
755
Views
0
Helpful
5
Replies

What is the HA_EM-6-LOG message for?

kaghytayu2
Level 1
Level 1

Hi all,

First and foremost apologies if this doesn''t belong here.

But I was wondering what the HA_EM-6-LOG: catchall XXXX messages are for on a 9800 WLC.

I''ve been trying to get messages over to Graylog but it seems the current setup contains no messages that are being sent because of some catchall.

Would you be able to enlighten me, or perhaps point me in the right direction as of to get logging to Graylog (message types).

Thanks in advance,

Eloy Lion

5 Replies 5

marce1000
VIP
VIP

 

 - Is the controller managed by DNAC ? If so this might be some provisioning setting  to send all the logs to DNAC (only) , 

 M.



-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
    When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

Rich R
VIP
VIP

From a Google search it looks like Graylog is a SIEM solution so they probably want you to send syslogs to the Graylog server.
First you need to know what logs they want and then you configure syslog as per the config guide:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/m_syslog_server.html#t_configuring_syslog_server_for_the_controller_gui.xml
CLI allows more granular configuration and filters than the GUI.

DJW487
Level 1
Level 1

Did you have TAC help at all with that WLC?
When I had some Catalyst Center provisioning issues with a switch, they got me to put this on:

event manager applet catchall
event cli pattern ".*" sync no skip no
action 1 syslog msg "$_cli_msg"

And it shows in the logs exactly what is happening behind the scenes when catalyst center was provisioning a switch, not just a generic message.

Is that applet on your WLC?

I've been able to get our WLC to log to Graylog after some trial and error, but it's just these messages now and it seems to be okay, but I'd need to dig deeper into getting AP logging to Graylog.
Although me adding those logs, might slow down the Graylog cluster

AP syslog is configured in the AP join profile:

ap profile default-ap-profile
 syslog facility <local5>
 syslog host a.b.c.d
 syslog level <debugging>
Configure facility and level according to your requirements.

Review Cisco Networking for a $25 gift card