Hacking Cisco Prime Syslog severity

Cisco Prime Infrastructure bietet eine Syslog Server Funktion, der Umfang ist jedoch begrenzt auf Serverities bis Stufe 3.
Über das GUI gibt es leider keine Möglichkeit diese Limitation zu umgehen, geht man jedoch via Console/SSH auf die Rootshell, kann man das entsprechende Konfig File editieren um weitere Stufen frei zuschalten.

 Zugriff auf Rootshell:

vvmwlc21/admin# root
Enter root password :
Starting root bash shell …
ade #

 Ausgabe des Syslog Konfig Files:

ade # cd /opt/CSCOlumos/conf/
ade # ls syslog_sev_filter.xml

ade # cat syslog_sev_filter.xml

<expression op=’OR‘>

<!– Error –>
<condition field=’severity‘ op=’EQUALS‘ value=’0′ />
<condition field=’severity‘ op=’EQUALS‘ value=’1′ />
<condition field=’severity‘ op=’EQUALS‘ value=’2′ />

</expression>
ade #

 

Um das Konfigfile zu editieren besteht die Möglichkeit dies mit dem Texteditor „VI“ zu tun. VI punktet allerdings nicht gerade mit Benutzerfreundlichkeit, deswegen ist es gegebenen Falls sogar einfacher sich das File via FTP runter zuladen, lokal zu editieren und wieder hochzuladen.

Repository erstellen

 Für den Zugriff auf den Prime FTP, muss zuerst ein entsprechendes Repository erstellt werden:

config t
repository ftp
url disk:/ftp
end

In FTP Verzeichnis kopieren:

ade # cp syslog_sev_filter.xml /localdisk/ftp/

File editieren:

In Rot sind die Zeilen für das freischalten weiterer Syslog Stufen


<expression op=’OR‘>

<!– Error –>
<condition field=’severity‘ op=’EQUALS‘ value=’0′ />
<condition field=’severity‘ op=’EQUALS‘ value=’1′ />
<condition field=’severity‘ op=’EQUALS‘ value=’2′ />
<condition field=’severity‘ op=’EQUALS‘ value=’3′ />
<condition field=’severity‘ op=’EQUALS‘ value=’4′ />
<condition field=’severity‘ op=’EQUALS‘ value=’5′ />
<condition field=’severity‘ op=’EQUALS‘ value=’6′ />
<condition field=’severity‘ op=’EQUALS‘ value=’7′ />

</expression>

 

File zurueck kopieren

ade # cp /localdisk/ftp/syslog_sev_filter.xml syslog_sev_filter.xml

 

Damit die neue Konfig aktiv wird, muss man die NCS Applikation neustarten

NCS stoppen:

> ncs stop verbose
Stopping Network Control System...
Stopping Network Control System server
Stopping Service Name: Reporting
Stopping Reporting
Reporting successfully shutdown.
Stopping Service Name: Ftp
Stopping NMS Server
Stopping Reporting Server(XMP) ..DONE
NMS Server successfully shutdown.

Stopping remoting: Ftp Server
Stopping FTP server...
Stopped FTP server.
Stopping Remoting Web Server Ftp Server...
Remoting Web Server Ftp Server stopped.
Remoting 'Ftp Server' stopped successfully.
Stopping Service Name: Database
Shutting down database server ...
Stopping XMP ....DONE

Stopping Service Name: Tftp
Stopping remoting: Tftp Server
Stopping TFTP server...
Stopped TFTP server.
Stopping Remoting Web Server Tftp Server...
Remoting Web Server Tftp Server stopped.
Remoting 'Tftp Server' stopped successfully.
Stopping Service Name: Matlab
Stopping remoting: Matlab Server
Stopping Remoting Web Server Matlab Server...
Remoting Web Server Matlab Server stopped.
Warning: latest version of matlab app-defaults file not found.
Contact your system administrator to have this file installed.
Remoting 'Matlab Server' stopped successfully.


Stopping Service Name: NMS Server
NMS Server is not running.
Stopping Tomcat...
Tomcat Stopped.

Network Control System successfully shutdown.

NCS starten:


 ncs start verbose
Starting Network Control System...

Starting Health Monitor
Starting Health Monitor as a primary
Checking for Port 8082 availability... OK
Starting Health Montior Web Server...
Health Monitor Web Server Started.
Starting Health Monitor Server...
Health Monitor Server Started.
Starting Service Name: Reporting
Starting dependency service: NMS Server
Starting dependency service: Matlab
Starting remoting: Matlab Server
Checking for Port 20555 availability... OK
Remoting Service Matlab Server application root: /opt/CSCOncs
Starting Remoting Service Web Server Matlab Server...
Remoting Service Web Server Matlab Server Started.
Starting Remoting Service Matlab Server...
Remoting 'Matlab Server' started successfully.
Starting dependency service: Ftp
Starting remoting: Ftp Server
Checking for Port 20558 availability... OK
Starting up FTP server
Started FTP
FTP Server started
Remoting Service Ftp Server application root: /opt/CSCOncs
Starting Remoting Service Web Server Ftp Server...
Remoting Service Web Server Ftp Server Started.
Starting Remoting Service Ftp Server...
Remoting 'Ftp Server' started successfully.
Starting dependency service: Tftp
Starting remoting: Tftp Server
Checking for Port 20559 availability... OK
Starting up TFTP server...
TFTP Server started.
Remoting Service Tftp Server application root: /opt/CSCOncs
Starting Remoting Service Web Server Tftp Server...
Remoting Service Web Server Tftp Server Started.
Starting Remoting Service Tftp Server...
Remoting 'Tftp Server' started successfully.
Starting NMS Server
Checking for running servers.
  Checking if DECAP is running.
  00:00 DECAP is not running.
00:00 Check complete. No servers running.
  00:10 DECAP setup complete.
Starting Server ...
Reporting started successfully

Starting Service Name: Ftp
Ftp is already running.

Starting Service Name: Database
00:40 Server started.
00:40 DONE
Done
Database is already running.

Starting Service Name: Tftp
Tftp is already running.

Starting Service Name: Matlab
Matlab is already running.

Starting Service Name: NMS Server
NMS Server is already running.

Network Control System started successfully.

Samuel Heinrich
Senior Network Engineer at Selution AG (Switzerland)
Arbeitet in Raum Basel (Switzerland) als Senior Network Engineer mit über 15 Jahren Erfahrung im Bereich Netzwerk

Schreibe einen Kommentar

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

Diese Website verwendet Akismet, um Spam zu reduzieren. Erfahre mehr darüber, wie deine Kommentardaten verarbeitet werden.