sysloganalyzer
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Last revision Both sides next revision | ||
|
sysloganalyzer [2007/10/07 09:46] faltin |
sysloganalyzer [2007/10/08 20:44] faltin |
||
|---|---|---|---|
| Line 3: | Line 3: | ||
| {{tools:syslog-analyzer.png|}} The syslog analyzer lets you browse Cisco syslog messages that | {{tools:syslog-analyzer.png|}} The syslog analyzer lets you browse Cisco syslog messages that | ||
| are collected by the syslog deamon. Only Cisco syslog messages are supported. | are collected by the syslog deamon. Only Cisco syslog messages are supported. | ||
| + | |||
| + | |||
| + | |||
| Line 9: | Line 12: | ||
| A requirement for this tool is that a syslog daemon is running on your NAV machine collecting syslog messages from your Cisco gear. Unfortunately the NAV Syslog Analyzer only supports Cisco syslog messages, other messages will be ignored (an improvement is on our road map). | A requirement for this tool is that a syslog daemon is running on your NAV machine collecting syslog messages from your Cisco gear. Unfortunately the NAV Syslog Analyzer only supports Cisco syslog messages, other messages will be ignored (an improvement is on our road map). | ||
| - | We recommend that you in your syslog configuration log syslog messages from your network equipment to **two parallel** files, one that is read (and emptied) by NAV and another that is untouched by NAV. The latter can be inspected as usual from shell (you should rotate as you do with other ever-growing log files). The one that NAV reads and empties is configured in the ''etc/logger.conf'' file. It is the NAV background process [[backendprocesses#the_cisco_syslog_analyzer_logengine|logger]] that does this job. Every minute the log file is checked for new messages. If any, they are removed from the file, parsed and inserted into the NAV logger database. | + | We recommend that you in your syslog configuration log syslog messages from your network equipment to **two parallel** files, one that is read (and emptied) by NAV and another that is untouched by NAV. The latter can be inspected as usual from shell (you should rotate as you do with other ever-growing log files). The one that NAV reads and empties is configured in the ''nav/etc/logger.conf'' file. It is the NAV background process [[backendprocesses#logengine|logengine]] that does this job. Every minute the log file is checked for new messages. If any, they are removed from the file, parsed and inserted into the NAV logger database. |
| ===== Cisco syslog message semantics and the NAV logger database ===== | ===== Cisco syslog message semantics and the NAV logger database ===== | ||
| Line 34: | Line 38: | ||
| </code> | </code> | ||
| - | See [[devel:database#the_logger_database|details on the NAV logger database]]. | + | [[devel:database#the_logger_database|The NAV logger database]] models this structure. |
| ===== The Syslog Analyzer front-end tool ===== | ===== The Syslog Analyzer front-end tool ===== | ||
| - | The Syslog Analyzer presents a search form where you can retrieve information you are interested in. You may in example see all message the last 24 hours that are of severity 3, or that has been received from a given switch. In the result each message type from a given source box is listed with the number of occurrences seen on this particular message type. By clicking on the number of occurrences further details will be listed. | + | The Syslog Analyzer presents a search form where you can retrieve information of your interest. You may for example see all messages the last 24 hours that are of severity 3, or that has been received from a given switch. In the presented result each message type from a given source box is listed with the number of occurrences seen for this particular message type. By clicking on the number of occurrences further details will be listed. |
| If there are cases of parsing errors, you can see these (i.e. where the logger process is not able to understand the message). | If there are cases of parsing errors, you can see these (i.e. where the logger process is not able to understand the message). | ||
sysloganalyzer.txt · Last modified: 2009/03/25 14:00 by morten
Page Tools
