This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

LEM & Syslog Levels

DeanBennett over 11 years ago

I'm currently trying LEM, it's successfully collecting data from my Active Directory DC's and DHCP servers. I'm now considering pointing some of our network equipment at LEM and was wondering what Syslog level I should set them at. I understand (from this video) Solarwinds recommend setting Syslog to debug, which would generate a great deal of data, however what impact is this likely to have on the performance of the devices running Syslog at debug level ?

I'm assuming the recommendation is focused primarily on getting as much information into LEM as possible, however as with most things, it's probably a balancing act of wait of data against performance impact.

Any guidance you can offer me would be gratefully received.

Top Replies

0 cmgurley over 11 years ago

For network devices, unless you are troubleshooting a very deep/detailed issue, I wouldn't recommend setting them to debug level. Info level seems to be a good setting in general, after which you can set it to debug if an issue arises. Granted, you won't be able to go back into debug data, but chances are you won't care about that data unless something big and consistent or recurring is happening. Like you said, debug on some devices (Cisco comes to mind) can be very detrimental to performance.
Thanks,
Chris
Cancel
Vote Up +1 Vote Down

Cancel
0 DeanBennett over 11 years ago in reply to cmgurley

Thanks Chris, makes perfect sense.
Cancel
Vote Up 0 Vote Down

Cancel
0 DeanBennett over 11 years ago

Feel like I'm probably missing something obvious. I've set a switch to point at my trial LEM server at informational level, following the instructions in http://knowledgebase.solarwinds.com/kb/questions/2866/Configuring+Cisco+IOS+Routers+and+Switches+to+Syslog+to+Your+LEM+Appliance. I'm getting nothing from the switch on LEM, I'm getting the same result with my Fortigate firewall, so I'm thinking maybe I'm missing something.
Anyone got any ideas.
Cancel
Vote Up 0 Vote Down

Cancel
0 phil3 over 11 years ago in reply to DeanBennett

Hi, Dean.
Have you tried the troubleshooting steps in this KB article?
SolarWinds Knowledge Base :: Troubleshooting Network Devices Logging to LEM
Let us know whether or not that helps.
Thanks.
Phil
Cancel
Vote Up 0 Vote Down

Cancel
0 cmgurley over 11 years ago in reply to DeanBennett
For my switches, I use the "Cisco PIX and IOS" tool that is under the "Firewalls" category. These are the settings of the tool, which I named "Switches":
Alias: Switches
Log File: /var/log/local7.log
Output: Alert
nDepth Host: localhost
nDepth Port: 10101
Sleep Time: 1
Wrapper Name: CiscoFirewalls
Tool Version: $Revision: 7070 $
I'm thinking the tool you're using isn't the right one (I'd tried it myself w/ the same results).
--Chris
Cancel
Vote Up +1 Vote Down

Cancel
0 DeanBennett over 11 years ago in reply to cmgurley

Thanks Chris, it turned out I was looking in the wrong place for the data in Explore - nDepth. I was searching on IntertionIP for the IP of the switch for activity, but it's actually under DetectionIP. All working as per the original Solarwinds article I posted previously.
Top tip from the link Phil posted was the "checklogs" command on the LEM console, that's how I could find it was communicating with the LEM, it was then just a case of finding it through the GUI.
Cancel
Vote Up 0 Vote Down

Cancel
0 DeanBennett over 11 years ago in reply to phil3

Phil,
It was the "checklogs" console command described in the Solarwinds troubleshooting guide which led to me getting to the bottom of my issue.
Thank you.
Cheers
Dean
Cancel
Vote Up 0 Vote Down

Cancel
0 phil3 over 11 years ago in reply to DeanBennett

My pleasure.
Cancel
Vote Up 0 Vote Down

Cancel