Hot answers tagged

7

There are 3 real ways to fix this, all of which are fairly simple. Automated Storage Cleanup Juniper has a system cleanup tool for handling this automatically. It operates almost exclusively under the /var/* directory structure; meaning it isn’t all that critical, unless you care about your log files (which you should!). Below is a system storage cleanup ...


6

Summary You should use Cisco's Embedded Syslog Manager. ESM can dynamically modify or throttle syslog messages when they are generated on the router. ESM Demo I built an example (see bottom of answer) of how to rate-limit configuration messages within a test time window; for the purposes of this demo, I substituted [regexp {CONFIG} $::orig_msg] instead of ...


6

Is this output from after a reboot? You may have 1232 lines since you rebooted the device, but only 14 messages since you setup the syslog server. The switch won't send any old messages, just newly-generated ones.


5

If you don't see those logs there anymore, they've most likely been rotated to reduce disk space used, but it could be that messages.19.gz contains logs from July, it all depends on when that log was created. So you could use show log messages.19.gz to check that. You can change the number of files stored on disk: set file messages archive files 100 Make ...


5

The syntax of the show log command is show log "filename". First try: show log This command will show you all files in the log directory. You will probably get the log entries you want simply by typing: show log messages.0.gz No need to think about decompressing the file. Junos will do this for you.


4

Found the manual that shows the format. The format is as follows: PRI Timestamp HostIP Address StackID Component Name Thread ID File name line number sequence number message


4

You can send configuration commands to the syslog server with the notify syslog command (Cisco IOS Configuration Fundamentals Command Reference): archive ! archive configuration mode log config ! change logger configuration mode logging enable ! log configuration changes notify syslog ! send change notifications to syslog server Examples ...


4

Syslog streaming is independent of the router resources since it sends configured logs to an external Syslog server. Losing the syslog would mean that these logs go back to the internal buffer. The internal buffer is allocated a piece of memory by the OS itself, but is user-configurable with values ranging from 4096 to approx 2 billion. However, setting a ...


3

As far as I could see, there is no Cisco document that describes what happens in the scenario that you mention. But even if there was such a document, you would be best advised to verify the behaviour for yourself, with your device and software version, because syslog is such an important component. Here is how I would verify it: Configure and verify the ...


3

The "debugging" level is way too detailed for most uses. As you can see, it generates a lot of messages; most are not helpful. Also, it puts a heavy load on the ASA. You can try logging trap info or logging trap warning to see which one gives you the information you need.


3

The above requirement worked for me using the below command on ASR9k logmsg [your message]


3

Alright, so action policy POLICY_NAME $arg doesn't pass arguments to the script - had to switch to action cli command "tclsh flash:/script.tcl $arg"` which does, HOWEVER... EEM actions are unable to capture beyond a newline from a variable. I did find a way out though - trim the newline from $_syslog_msg (newline is the first char) and assign to a new ...


3

When logging to an external or syslog server, only new log entries are sent to the server. Old log entries will not be sent. You probably only have 14 log messages because that is all that have been generated since you installed the syslog server.


3

Trap logging: disabled That's the first problem. "trap" is the mechanism that sends to syslog hosts. logging trap informational will start messages flowing, but on an active firewall, there will a lot of messages. You can cut down the spew by increasing the logging level (info, warn, error, crit, etc.), or better, turn off the messages you don't want to see:...


2

Typically, log filtering is done on syslog servers, not on routers, but if you really want to do this on your router, it's possible. A very simple way to achieve it is to set your log level higher than informational, but that filters out more than just cron messages, so that probably isn't such a good idea. But there's a nice KB article on how to filter ...


2

The closest IOS equivalent to the ASA's logging message command is the Embedded Syslog Manager (ESM) feature. It offers similar capabilities, but is far more flexible (and, consequently, more complex). I've never needed to use it, but based on a quick reading of the documentation, it works like this: Create one or more logging filters in TCL. In your case, ...


2

Yes, you can with Cisco gear at least (and probably also with most other vendors). For syslog: logging 10.1.1.1 logging 10.1.1.2 For SNMP traps: snmp-server host 10.1.1.1 version 2c @str!ng snmp-server host 10.1.1.2 version 2c @str!ng


2

There's a protocol created by Cisco for this very purpose: netflow. You have to check if your version of IOS support it, and you need a netflow collector that will receive and record the information from the switch. Cisco reference some free Netwflow software on this page but there's plenty others. Many software provide both the syslog and the netflow ...


2

Cisco ACS can't be used as syslog server, but it could be used as AAA server which is include Accounting: if you are looking to use ACS as accounting server for management account which is include logging for the commands and changes done by any ASA user you have to define the ACS as tacacs server for the ASA you could find more info on this link: ASA 8....


2

Ok I believe I found the problem. My remote sites have their own routers with their own internet connection. We don,t really use it for anything other than an IPSEC tunnel back to HQ to use as a backup WAN link.. I use EIGRP to build my route tables, so these routers at my remote sites happen to not have a static default route. So anytime their public IP is ...


1

With these protocols running there has to be syslog messages for exchanges go between our devices and customer devices. "logging trap debugging" This command means that every log message is allowed to be sent to syslog server. However to generate the debug logs in first place, you need to enable debugging itself with debug command For example to ...


1

When a public IP address shows up inside your private network you should track it down. Check the ARP table on the ASA whether the source is connected directly or work from there to the source router. Once you've got the source MAC you work through your switches to find the source port.


1

The send command is used to send messages between users logged into the same router. send - To send messages to one or all terminal lines, use the send EXEC command. send {line-number | * | aux number | console number | tty number | vty number} Syntax Description Defaults No messages are sent. Command Modes EXEC ...


1

Cisco has a large listing of Syslog Messages and Severity level here: Syslog Messages This list includes Syslog Messages for the following: IOS Software Release 15SY IOS Software Release 12.2SY IOS Software Release 12.2SX ASA Services Module For the IOS Guides, you have to drill into the individual error messages to find the severity level. The ASA has a ...


1

A five second google search told me that: faddr = foreign address gaddr = global address (after NAT) laddr = local address (pre NAT) Since this is an inbound connection, the source IP address is the foreign one : 10.1.6.3 The original destination address is 10.24.5.2 which has been translated to the final destination address 10.4.1.2


1

Write an EEM script that looks for your syslog message at level 6 and in response emits a syslog message at log 5 or better. Note: I don't know if this works on your device/IOS version. The following example "converts" a level 5 syslog (the "%SYS-5-CONFIG_I" log you see when you make config changes and exit the config mode) to a level 2 syslog. Note the ...


1

Cisco IOS Configuration Fundamentals Configuration Guide, Release 12.2 Troubleshooting, Fault Management, and Logging You just finish your standard ACL statement with the log keyword. The level of logging is configured per logging destination. Note this may negatively impact performance of your networking device. Use with caution.


1

The logging discriminator might be the feature you are looking for here. http://www.cisco.com/c/en/us/td/docs/ios/12_4t/12_4t11/htnmsylg.html#wp1056391 The format of such a discriminator is as follows : logging discriminator discr-name [[facility | mnemonics | msg-body {drops | includes} string] | severity {drops | includes} sev-num | rate-limit msglimit] ...


Only top voted, non community-wiki answers of a minimum length are eligible