28.06.2014 Views

Discussion

Discussion

Discussion

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

This command causes all messages sent to the remote host to be flagged with the<br />

standard local0 facility. On the server, you map to a file in the /etc/syslog.conf file:<br />

local0.*<br />

/var/log/M20-JUNOS-cookbook-messages<br />

A check of the file shows the system log messages from the router:<br />

aviva-server1%: tail -4 M20-JUNOS-cookbook-messages<br />

Mar 24 00:45:40 router1-fxp0.mycompany M20-JUNOS-cookbook: mgd[5257]:<br />

%INTERACT-6-UI_CMDLINE_READ_LINE: User 'aviva', command 'edit system syslog '<br />

Mar 24 01:00:00 router1-fxp0.mycompany M20-JUNOS-cookbook: CRON[8784]:<br />

%CRON-6: (root) CMD (newsyslog)<br />

Mar 24 01:01:00 router1-fxp0.mycompany M20-JUNOS-cookbook: CRON[8787]:<br />

%CRON-6: (root) CMD (adjkerntz -a)<br />

Mar 24 01:08:04 router1-fxp0.mycompany M20-JUNOS-cookbook: mgd[5257]:<br />

%INTERACT-6-UI_CMDLINE_READ_LINE: User 'aviva', command 'edit host server1 '<br />

You can run system logging management software on the central log server to help<br />

analyze the collected log messages. One widely used product is syslog-ng (http://<br />

www.balabit.com/products/syslog_ng), which filters logging messages based on source<br />

IP address and separates messages from different sources into different files instead<br />

of placing them into one file. This is particularly useful for network operators who<br />

aggregate messages from several devices. Another widely used tool is swatch (simple<br />

watcher; http://swatch.sourceforge.net), which actively scans logfiles entries as soon<br />

as syslogd receives them and reports what is happening in real time. swatch can also<br />

take action when it encounters certain log messages.<br />

5.8 Saving Logging Messages to the Other Routing<br />

Engine<br />

Problem<br />

Your router has a second Routing Engine for redundancy, but the router runs fine off<br />

the primary Routing Engine and never fails over to the second one. You want to take<br />

advantage of the storage space available on the second Routing Engine’s hard disk to<br />

save some of your logging messages.<br />

Solution<br />

Redirect the logging messages to the other Routing Engine:<br />

[edit system syslog]<br />

aviva@router1# set host other-routing-engine authorization notice<br />

<strong>Discussion</strong><br />

If you always run your router off the primary Routing Engine (RE0), there is likely a<br />

lot of available hard disk space on the second Routing Engine’s hard disk that you<br />

Saving Logging Messages to the Other Routing Engine | 175<br />

This is the Title of the Book, eMatter Edition<br />

Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!