Table Of Contents
System Log Management Configuration
Understanding System Log Management
Directing Syslog Messages
Directing Messages to Local Syslog Analyzer Collector
Directing Messages to CiscoWorks2000 Server
Enabling the SNMP Agent
System Log Management Configuration
This chapter, which provides an overview of system log, contains the following topics:
•Understanding System Log Management
•Directing Syslog Messages
•Enabling the SNMP Agent
In an open distributed system, multiple applications generally run on several machines of different types. Cisco Syslog Analysis streamlines the management of such systems by providing a common administrative interface for all log messages that are received from the applications.
The result provides an orderly presentation of information that assists in the diagnosis and troubleshooting of system problems.
Understanding System Log Management
Although it can be adapted to other network management systems, Cisco Syslog Analysis, which is packaged with CiscoWorks2000 Resource Manager Essentials, provides the best method to manage Syslog messages from Cisco devices.
Cisco Syslog Analyzer serves as the component of Cisco Syslog Analysis that provides a common storage and analysis of the system log for multiple applications. The other major component, Syslog Analyzer Collector, gathers log messages from Cisco CallManager servers.
These two Cisco applications work together to provide a centralized system logging service for Cisco IP Telephony Solutions.
A diagram of the system (Figure 27-1) shows how the Syslog Analyzer and Syslog Collector function within the syslog analysis process.
Figure 27-1 Functional Components of the System Logging Service
Directing Syslog Messages
You can configure Cisco CallManager applications to send Syslog messages directly to the CiscoWorks2000 server or to a local host on which the Remote Syslog Analyzer Collector (RSAC) software is installed.
Refer to the CiscoWorks2000 installation procedures for the Resource Manager Essentials at the following Internet address: http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/index.htm
Refer to the CiscoWorks2000 online documentation for information about the Remote Syslog Analyzer Collector.
The Cisco CallManager Serviceability interface directs the syslog output and initiates the logging activity. See "Alarm Configuration," for more information.
Directing Messages to Local Syslog Analyzer Collector
Perform the following procedures to direct Syslog messages to a local host.
Step 1 From the Cisco CallManager Administration window, choose Application > Cisco CallManager Serviceability.
The Cisco CallManager Serviceability window displays.
Step 2 Choose Alarm > Configuration.
Step 3 From the Servers column, choose the server.
The server that you chose appears after the Current Server title, and a box with configurable services displays.
Step 4 From the Configured Services list, choose the service for which you want to configure the alarm.
The service that you chose displays after the Current Service title, along with the current server that you chose. A list of alarm monitors with the event levels displays in the Alarm Configuration window.
Step 5 Check the Enable Alarm for Syslog check box.
Step 6 In the Alarm Event Level selection box, click the Down arrow.
A list with eight event levels displays.
Step 7 Click the desired alarm event level.
Step 8 Leave the Server Name box blank to send Syslog messages to a local host.
Step 9 To save your configuration, click Update.
Directing Messages to CiscoWorks2000 Server
Perform the following procedures to send Syslog messages directly to the CiscoWorks2000 server.
Step 1 From the Cisco CallManager Administration window, choose Application > Cisco CallManager Serviceability.
The Cisco CallManager Serviceability window displays.
Step 2 Choose Alarm > Configuration.
Step 3 From the Servers column, choose the server.
The server that you chose appears after the Current Server title, and a box with configurable services displays.
Step 4 From the Configured Services list, choose the service for which you want to configure the alarm.
The service that you chose displays after the Current Service title, along with the current server that you chose. A list of alarm monitors with the event levels displays in the Alarm Configuration window.
Step 5 Check the Enable Alarm for Syslog check box.
Step 6 In the Alarm Event Level selection box, click the Down arrow.
A list with eight event levels displays.
Step 7 Click the desired alarm event level.
Step 8 In the Server Name box, enter the CiscoWorks2000 server name.
Step 9 To save your configuration, click Update.
Enabling the SNMP Agent
Because CiscoWorks2000 sends SNMP requests to query for device information, you must enable the Microsoft Windows 2000 SNMP service at the time that Cisco CallManager is installed.
Adding a system adds device databases to the CiscoWorks device list, and SNMP requests are used to retrieve that information. See "Simple Network Management Protocol Configuration," for more information.