topic RE: Syslog entries missing in XMC Events window in ExtremeCloud IQ- Site Engine Management Center

Syslog entries missing in XMC Events window

DH1 — Mon, 11 Mar 2019 21:15:00 GMT

Just upgraded to XMC 8.2.4.42 and was hoping it would fix the issue with my syslog events now showing in the Events window. If I go to the Syslogs folder on the server I see them there but for some reason they are not getting replicated to the Event window.

RE: Syslog entries missing in XMC Events window

Ronald_Dvorak — Mon, 11 Mar 2019 21:22:00 GMT

Here my 8.2 view which incl Syslog messages....

-Ron

RE: Syslog entries missing in XMC Events window

DH1 — Mon, 11 Mar 2019 21:49:00 GMT

This is all I have and I have over 130 switches setup to send syslog info to XMC.

RE: Syslog entries missing in XMC Events window

Ronald_Dvorak — Mon, 11 Mar 2019 22:17:00 GMT

Just in case my syslog config and the output of the show command of my X440G2 running 22.6.1.4.

X440G2.7 # show config | i syslog
configure syslog add 172.24.24.110:514 vr VR-Default local0
enable log target syslog 172.24.24.110:514 vr VR-Default local0
configure log target syslog 172.24.24.110:514 vr VR-Default local0 filter DefaultFilter severity Info
configure log target syslog 172.24.24.110:514 vr VR-Default local0 match Any
configure log target syslog 172.24.24.110:514 vr VR-Default local0 format timestamp seconds date Mmm-dd event-name none priority host-name tag-name

X440G2.8 # sh log configuration target syslog
Log Target : syslog; 172.24.24.110:514 (vr VR-Default), local0
Enabled : yes
Filter Name : DefaultFilter
Match regex : Any
Severity : Info (through Critical)
Format : PRI Mmm DD HH:MM:SS HOSTNAME TAG:
Port Type : UDP

RE: Syslog entries missing in XMC Events window

Bernhard_Gruenw — Mon, 11 Mar 2019 23:01:00 GMT

I had also no syslog entries under Events.
I had to configure in Event Configuration - Event Logs - Syslog the correct Directory.
/var/log/syslog and Ubuntu LINUX Syslog Pattern.
In my case here was /var/log/Messages and RedHad.
After this Change the syslog entries appear

RE: Syslog entries missing in XMC Events window

DH1 — Mon, 11 Mar 2019 23:38:00 GMT

code:

* Switch.2 # show config | i syslog
configure syslog add 10.230.30.21:514 vr VR-Default local7
enable log target syslog 10.230.30.21:514 vr VR-Default local7
configure log target syslog 10.230.30.21:514 vr VR-Default local7 filter DefaultFilter severity Debug-Data
configure log target syslog 10.230.30.21:514 vr VR-Default local7 match Any
configure log target syslog 10.230.30.21:514 vr VR-Default local7 format timestamp seconds date Mmm-dd event-name none priority tag-name 

* Switch.3 # sh log config target syslog
Log Target      : syslog; 10.230.30.21:514 (vr VR-Default), local7
    Enabled     : yes
    Filter Name : DefaultFilter
    Match regex : Any
    Severity    : Debug-Data (through Critical)
    Format      : PRI Mmm DD HH:MM:SS TAG:

Our configs look close so I don't think that is the issue. This is a windows machine and the default directory is 

Syslog 
Directory C:\Program Files\Extreme Networks\NetSight\appdata\logs/syslogs polled every 60 seconds

RE: Syslog entries missing in XMC Events window

Ronald_Dvorak — Tue, 12 Mar 2019 01:52:00 GMT

Is that a typo in the link / instead of \ ?!

RE: Syslog entries missing in XMC Events window

DH1 — Tue, 12 Mar 2019 20:27:00 GMT

No, that is how it is in the config for all modules. Screen shot included below.

RE: Syslog entries missing in XMC Events window

DH1 — Wed, 13 Mar 2019 01:48:00 GMT

I found the following article that explains after upgrading to 8.2 you need to clear your browsers cache to see all the events.

https://gtacknowledge.extremenetworks.com/articles/Solution/xmc-Filters-ignored-in-the-Event-tab-after-upgrade-to-v8-2

I did this and now all my Syslogs are showing in the events tab.