On Wed, 2008-12-17 at 15:54 -0500, Tuc at T-B-O-H wrote: > We are going to be monitoring the syslog output (We already have > a product (Zenoss)). Does anyone know of a repository of the "Watch > for these regular expressions" to decide what is worth looking into, > and whats worth ignoring.
I don't know of a repository but would also gladly hear about one. Until we find it, we use what should have been "common sense", but often turns out to be circumstances/arbitrary. :-) For our access-switches this means ignoring "^%CDP-4-DUPLEX_MISMATCH.*, with SEP" (we don't generally disable CDP downstream (I know!) and sometimes people use Cisco IP phones / ATA boxes behind non-CDP switches. What gives?). For the same general reason we don't always react immediately on seeing "^%CDP-4-NATIVE_VLAN_MISMATCH". (It's a "yellow" code.) Generally we ignore link/line-proto changes in VLAN interfaces, relying on only changes in physical interfaces. That means that we always ignore "^%LINEPROTO-5-UPDOWN.* Vlan.* up ". Most other messages are collected, logged and mailed to the NOC. A few message types are reacted upon in a more direct way, sending out text messages (SMS) to several people and playing irritating sounds from hidden speakers in the NOC. Those are messages like "^%LDP-5-NBGCHG.* is DOWN", "^%BGP-5-ADJCHANGE.* Down" and "^%ENVM-4-ENVWARN". Apart from this we correlate logs on anomalities, e.g. an RTR probe exceeding some threshold or a NFsen alert being triggered. The correlation is strictly time based, but it usually gives an operator some clue as to what's happening. Regards, Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
