Cisco Connector is Not Showing Up

Everytime I add the node from my Cisco 3845 router the LEM server tells me it finds a tippingpoint node connector.

When I disable the tippingpoint connector then LEM simply tells me it can't find a new node.

I know that the router is sending the syslog msgs to the LEM server in local2.

I tried at first to just go with the tippingpoint connector, but when you view the events there are a lot of unmatched cisco switch data.

  • Thank you, but it does not help.

    I spent quite a bit of time reading about this before posting, and I had already looked at that question.


    The above user had his cisco ios/IPX connector show up magically some time later, but mine is not.


    It continues to be listed under the tippingpoint connector, which is parsing the log incorrectly.

  • Go into the Connectors on the Appliance.  Stop and remove the Tipping Point connectors.  In the search box, enter "Cisco" and pick the IOS connector.  Create a new connector reading local2 (which should be the default), save and start it.

    Also, there was an issue with a version of the TippingPoint connector, so you may want to enable the connector updates on your LEM to address that.

  • I have been with dozens of client who have improperly configured syslog connectors using the auto feature.

    When ever LEM notifies us that it found a new node, I typically cancel it and talk with the networking people if they configured a device to send syslog to LEM.  Once confirmed, cmc into LEM and look at the checklogs to validate that the data is coming in the correct facility.  Also check if that facility is being used by another connector.  If everything checks out, then create a connector using the appropriate facility.

    Once that is done, it is very important to create a filter to validate that you are receiving the information you are expecting.  Also look for any unmatched data from the connector.

    If you notice any unmatched data, then verify that you have the recent revision of the connector.  If not, then update the connector and validate.

    Validation is a very important step in the process.

    Thanks

    Amit Shah

    Loop1 Systems