Differences

This shows you the differences between two versions of the page.

--- sysloganalyzer [2007/10/07 09:50]
faltin
+++ sysloganalyzer [2009/03/25 14:00] (current)
morten update cisco log structure description and add more examples
@@ Line 3: / Line 3: @@
 {{tools:syslog-analyzer.png|}} The syslog analyzer lets you browse Cisco syslog messages that
 are collected by the syslog deamon. Only Cisco syslog messages are supported.
@@ Line 10: / Line 12: @@
 A requirement for this tool is that a syslog daemon is running on your NAV machine collecting syslog messages from your Cisco gear. Unfortunately the NAV Syslog Analyzer only supports Cisco syslog messages, other messages will be ignored (an improvement is on our road map).
-We recommend that you in your syslog configuration log syslog messages from your network equipment to **two parallel** files, one that is read (and emptied) by NAV and another that is untouched by NAV. The latter can be inspected as usual from shell (you should rotate as you do with other ever-growing log files). The one that NAV reads and empties is configured in the ''nav/etc/logger.conf'' file. It is the NAV background process [[backendprocesses#the_cisco_syslog_analyzer_logengine|logger]] that does this job. Every minute the log file is checked for new messages. If any, they are removed from the file, parsed and inserted into the NAV logger database.
+We recommend that you in your syslog configuration log syslog messages from your network equipment to **two parallel** files, one that is read (and emptied) by NAV and another that is untouched by NAV. The latter can be inspected as usual from shell (you should rotate as you do with other ever-growing log files). The one that NAV reads and empties is configured in the ''nav/etc/logger.conf'' file. It is the NAV background process [[backendprocesses#logengine|logengine]] that does this job. Every minute the log file is checked for new messages. If any, they are removed from the file, parsed and inserted into the NAV logger database.
@@ Line 30: / Line 32: @@
 </code>
-For a given syslog message a description follow the message type giving further details. Also a time stamp is given and the device the message was received from. An example:
+For any given syslog message, the following are typically found after the syslog server's timestamp:
+  * The name of the originating device
+  * A timestamp
+  * The Cisco message type descriptor
+  * The text of the message being logged
+[[devel:database#the_logger_database|The NAV logger database]] models this structure.
+Some valid examples are:
 <code>
 May 27 08:32:58 mtfs-sw.ntnu.no 2002 May 27 08:32:53 MET +02:00 %CDP-4-NVLANMISMATCH:Native vlan mismatch detected on port 4/2
+Feb  8 12:58:40 158.38.0.51 316371: Feb  8 12:58:39.873 MET: %SEC-6-IPACCESSLOGDP: list 112 permitted icmp 158.38.60.10 -> 158.38.12.5 (0/0), 1 packet
+Mar 25 10:54:25 somedevice 72: AP:000b.adc0.ffee: *Mar 25 10:15:51.666: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up
 </code>
-[[devel:database#the_logger_database|The NAV logger database]] models this structure.
+Incidentally, the log parsing engine has a bug in NAV versions prior to NAV 3.5.3, which cause it to crash if the following format is used (i.e. a year in the originating device's timestamp):
+<code>
+Mar 20 10:27:26 sw_1 607977: Mar 20 2009 10:20:06: %SEC-6-IPACCESSLOGP: list fraVLAN800 denied tcp x.x.x.x(1380) -> y.y.y.y(80), 2 packets
+</code>

NAV Wiki

User Tools

Site Tools

Differences

Page Tools