info-center: Send logbuffer to Syslog

[MichaelM55]

Hi,

I´m struggling with info-center and syslog. Perhaps someone could give me some hints. What would I like to do:

Everything that I can see when I enter "display logbuffer" should be sent to the syslog server (10.10.10.1).

info-center enable

info-center loghost 10.10.10.1 channel 4
info-center syslog channel 4

There´s actualle something missing. But what entries should be added?

Regards,

[MichaelM55]

Can I adjust the syntax of Syslog messages? It seems I need RFC5424.

[sdide]

hi MichaelM55,

configuring the info-center, there is a lot of defaults you need to be aware of.

I recommend reading the the configuration guide on Management and Monitoring for your specific switch.

as an example i've linked to the HP 7500 manual (comware 5)

http://h20566.www2.hp.com/hpsc/doc/public/display?sp4ts.oid=4177519&docId=emr_na-c03586724&docLocale=en_US

The section about info-center is a read worthwhile.

secondly you need to know how your loghost (maybe a syslog server) is configured or how you want to configure it, if you're there admin of the loghost.

I use facility local1 on my syslog server to log switchmessages. On the switch i use  "Default output rules" for log host (log everything, but debugging)

channel 2 is named "loghost" and defaults output to Log host. 

so i have just :

info-center loghost <loghost-A-ip-addrees> facility local1

info-center loghost <loghost-B-ip-address> facility local1

thats all i need.

Regards

[Apachez-]

I currently use these settings on a A5820 (Comware v5) to forward everything in the local log to a syslog-server (you need to replace the 1.2.3.4 with whatever ip your syslog-server has):

info-center source default channel 0 log state off trap state off
info-center source default channel 1 log state off trap state off
info-center source default channel 2 trap level informational debug level informational
info-center source default channel 4 trap level informational debug level informational
info-center loghost source LoopBack0
info-center loghost 1.2.3.4
info-center logbuffer size 1024
info-center trapbuffer size 1024
info-center synchronous
info-center timestamp loghost iso
undo info-center logfile enable

[kerwin]

Is it possible to configure what to be included in the syslog?

I would like to include the Description of the Interface when there's a status change sent to the log so the operators can see a more meaningful message instead of the log telling her the GigabitEthernet1/0/1 was down. Thanks.

[sdide]

Hi,

I do not beleive you can alter the content of the log messages in that way.

Of course you do get the IP and a unique interface in the log-message. So you should be able to post-parse your logs and retrieve the information via for example snmp.

Of course thats not what you asked, but I don't think you can alter the content of the log messages. You can change the format, but not the content.

Regards 

[kerwin]

I see. Thank you. 

[ivgarrid]

Hi S0ren,

Actually I have a HPE5900 switch and a Rsyslog server, about the configuration, I need to match the channel number and facility number, between switch and syslog server? only the facility number?

Thanks in advance.

Iván Garrido

[sdide]

Hi,

I think on the 5900, you just need to tell which facility you want to send to.  (and possibly which port the server listens on, if it deviates from the default). In this example lets say facility local5

info-center loghost <ip-address-of-rsyslog-server> facility local5

On the rsyslog server, you can do myriads of things.

Either you can use the set facilit (local5) and do something like (Property-based filters):

:syslogfacility-text,isequal,"local5"		/var/log/mylocal5.log

so everything that logs towards that rsyslogserver on facility local5 goes into "/var/log/mylocal5.log" including the above configured HPE5900.

or if you want messages just from that switch (say it has management ip 10.0.1.5 ) in a particular logfile you could do

:fromhost-ip,isequal,"10.0.1.5"		/var/log/my5900.log

but you probably already have somekind of system set up of how and where you want your logs to be written.

Regards.

[Mike79]

---

@kerwin wrote:

Is it possible to configure what to be included in the syslog?

I would like to include the Description of the Interface when there's a status change sent to the log so the operators can see a more meaningful message instead of the log telling her the GigabitEthernet1/0/1 was down. Thanks.

---

I have exmaple from Cisco world (NX-OS) of such command and it works expected:

logging message interface type ethernet description

logging event link-status enable
logging event trunk-status enable

and then:

snmp-server enable traps syslog

Any idea how to implement the same for Comware family?

Michal