|
|
An event is any significant occurrence within or affecting the VPN 3000 Concentrator, such as an alarm, trap (an event message sent to an SNMP system is called a "trap"), error condition, network problem, task completion, threshold breach, or status change. The VPN Concentrator records events in an event log, which is stored in nonvolatile memory. You can also specify that certain events trigger a console message, a UNIX syslog record, an e-mail message, or an SNMP management system trap.
Event attributes include class and severity level.
Event class denotes the source of the event and refers to a specific hardware or software subsystem within the VPN Concentrator. Table 10-1 lists the event classes.
Table 10-1 VPN Concentrator Event Classes
|
 |
Note The Cisco-specific event classes provide information that is meaningful only to Cisco engineering or support personnel. Also, the DBG and DECODE events require significant system resources and might seriously degrade performance. We recommend that you avoid logging these events unless Cisco requests it. |
Severity level indicates how serious or significant the event is,. It indicates how likely it is to cause unstable operation of the VPN concentrator, whether it represents a high-level or low-level operation, or whether it returns little or great detail. Level 1 is most significant. Table 10-2 describes the severity levels.
Table 10-2 VPN Concentrator Event Severity Levels
|
Within a severity level category, higher-numbered events provide more details than lower-numbered events, without necessarily duplicating the lower-level details. For example, within the Information category, Level 6 provides greater detail than Level 4, but does not necessarily include the same information as Level 4.
Logging higher-numbered severity levels causes performance to deteriorate, since more system resources are used to log and handle these events.
|
Note The Debug (7-9) and Packet Decode (10-13) severity levels are intended for use by Cisco engineering and support personnel. We recommend that you avoid logging these events unless Cisco requests it. |
The VPN Concentrator, by default, displays all events of severity level 1 through 3 on the console. It writes all events of severity level 1 through 5 to the event log. You can change these defaults on the Configuration | System | Events | General screen, and you can configure specific events for special handling on the Configuration | System | Events | Classes screens.
The VPN Concentrator records events in an event log, which is stored in nonvolatile memory. Thus the event log persists even if the system is powered off. For troubleshooting any system difficulty, or just to examine details of system activity, consult the event log first.
The Model 3015-3080 event log holds 2048 events, the Model 3005 holds 256 events. The log wraps when it is full; that is, newer events overwrite older events when the log is full.
For the event log, you can configure:
Each entry (record) in the event log consists of several fields including:
For more information, see the Monitoring | Filterable Event Log screen.
This section of the Manager lets you configure how the VPN Concentrator handles events. Events provide information for system monitoring, auditing, management, accounting, and troubleshooting.
This Manager screen lets you configure the general, or default, handling of all events. These defaults apply to all event classes.
You can override these default settings by configuring specific events for special handling on the Configuration | System | Events | Classes screens.
Check the Save Log on Wrap check box to automatically save the event log when it is full. (The box is unchecked by default.) The Model 3015-3080 event log holds 2048 events, the Model 3005 holds 256 events. When the log is full, newer events overwrite older events; that is, entry 2049 overwrites entry 1, etc.
If you select automatic save, the system saves the log file to a file in Flash memory with the filename LOGNNNNN.TXT, where NNNNN is an increasing sequence number that starts with 00001 and restarts after 99999. The sequence numbers continue through reboots. For example, if four log files have already been saved, the next one saved after a reboot is LOG00005.TXT.
If Flash memory has less than 2.56 MB of free space, the system deletes the oldest log file(s) to make room for the newest saved log file. It also generates an event that notes the deletion. If there are no old log files to delete, the save function fails, and the system generates an event that notes the failure.
Each saved log file requires about 334 KB. To conserve space in Flash memory, we recommend that you periodically remove the saved log files. Keeping more than 10 to 12 files wastes space. The Administration | File Management | Files screen shows total, used, and free space in Flash memory.
You can manage saved log files with options on this screen and on the Administration | File Management screens.
Click the Save Log Format drop-down menu button to specify the format of the saved log files.
Refer to the section on Monitoring | Filterable Event Log in VPN 3000 Series Concentrator Reference Volume II: Administration and Monitoring for details on event log fields.
Check the FTP Saved Log on Wrap check box to automatically send the saved event log file, when it wraps, via FTP to a remote computer. (The box is unchecked by default.) This option copies the log file but does not delete it from the VPN Concentrator. If you check this box, you must also configure FTP destination system parameters on the Configuration | System | Events | FTP Backup screen.
Enter the address to put in the From: field of an e-mailed event message. Enter up to 48 alphanumeric characters with no spaces, for example: cisco@cisco.com. You should configure this field if you configure any Severity to E-mail events; if you leave it blank, the From: field has the same address as the To: field (the recipient's e-mail address).
Click the Syslog Format drop-down menu button and choose the format for all events sent to syslog servers. Choices are:
Sequence Date Time SEV=Severity Class/Number RPT=RepeatCount String
Sequence: Date Time TimeZone TimeZoneOffset %Class-Severity-Number: RPT=RepeatCount: String
The Original severities and the Cisco IOS severities differ. Original severities number from 1-13. (For the meaning of each Original severity, see Table 10-2.) Cisco IOS severities number from 0-7. Table 10-3 shows the meaning of Cisco IOS severities and how they map to Original severities.
Click the Events to Log drop-down menu button and choose the range of event severity levels to enter in the event log by default. The choices are: None, Severity 1, Severities 1-2, Severities 1-3, Severities 1-4, Severities 1-5 and Use Event List. The default is Severities 1-5. Using the default means that all events of severity level 1 through severity level 5 are entered in the event log. If you choose Use Event List, configure the Event List to specify the event types to log.
Click the Events to Console drop-down menu button and choose the range of event severity levels to display on the console by default. The choices are: None, Severity 1, Severities 1-2, Severities 1-3, Severities 1-4, Severities 1-5 and Use Event List. The default is Severities 1-3. Using the default means that all events of severity level 1 through severity level 3 are displayed on the console. If you choose Use Event List, configure the Event List to specify the event types to display on the console
Click the Events to Syslog drop-down menu button and choose the range of event severity levels to send to a syslog server by default. The choices are: None, Severity 1, Severities 1-2, Severities 1-3, Severities 1-4, Severities 1-5 and Use Event List. The default is None. Using the default means that no events are sent to a syslog server. If you choose Use Event List, configure the Event List to specify the event types to send to the syslog server.
If you select any severity levels to send, you must also configure the syslog server(s) on the Configuration | System | Events | Syslog Servers screens.
Click the Events to E-mail drop-down menu button and choose the range of event severity levels to e-mail to recipients by default. The choices are: None, Severity 1, Severities 1-2, Severities 1-3, and Use Event List. The default is None. Using the default means that no events are sent via e-mail. If you choose Use Event List, configure the Event List to specify the event types to e-mail.
If you select any severity levels events to e-mail, you must also configure an SMTP server on the Configuration | System | Events | SMTP Servers screens, and you must configure e-mail recipients on the Configuration | System | Events | E-mail Recipients screens. You should also configure the preceding E-mail Source Address.
Click the Events to Trap drop-down menu button and choose the range of event severity levels to send to an SNMP network management system by default. Event messages sent to SNMP systems are called "traps." The choices are: None, Severity 1, Severities 1-2, Severities 1-3, and Use Event List. The default is None: no events are sent as SNMP traps. If you choose Use Event List, configure the Event List to specify the event types to trap.
If you select any severity levels to send, you must also configure SNMP destination system parameters on the Configuration | System | Events | Trap Destinations screens.
The VPN Concentrator can send the standard, or "well-known," SNMP traps listed in Table 10-4. To have an SNMP NMS receive them, you must configure the events as in the table, and configure a trap destination.
Table 10-4 Configuring "Well-Known" SNMP Traps
Use the Event List text box to define particular events that you want to track. This feature allows you to pare down the event log to contain just the events that interest you. You can track events by class, severity, or event ID.
You can use this feature in two ways. You can set global defaults to track this customized list, sending the results to your preferred event destination (log, console, syslog, e-mail, or trap). Or, you can override global defaults to track this customized list for an individual event class.
| If you want to... | Follow these steps: |
|---|---|
Set global defaults to track this customized list of events. |
|
Override any global defaults for a particular event class to track these events only, within that class. |
|
Each line in the Event List represents one entry. Each entry has the following format: <Event Class> / <List of Event IDs or Severity Numbers> where:
|
| 1 For the ALL event class, you can specify only event severities, not particular event numbers. For example, ALL/SEV(1) is a valid entry; ALL/123 is not. |
The following lines are examples of valid event list entries:
To include your settings for default event handling in the active configuration, click Apply. The Manager returns to the Configuration | System | Events screen.
To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window. To discard your settings, click Cancel. The Manager returns to the Configuration | System | Events screen.
This screen lets you configure parameters for using FTP to automatically back up saved event log files on a remote computer. If you enable FTP Saved Log on Wrap on the Configuration | System | Events | General screen, you must configure the FTP parameters on this screen.
The VPN Concentrator acts as an FTP client when executing this function.
|
Note Another way to back up saved event log files on a remote computer is to enable an external Syslog server. |
Enter the IP address or host name of the destination computer to receive copies of saved event log files via FTP. (If you have configured a DNS server, you can enter a host name; otherwise enter an IP address.)
Enter the complete directory path name on the destination computer to receive copies of saved event log files. For example, c:\vpn\logfiles.
Enter the username for FTP login on the destination computer.
Enter the password to use with the FTP username. The field displays only asterisks.
Re-enter the FTP password to verify it. The field displays only asterisks.
To include your FTP backup system settings in the active configuration, click Apply. The Manager returns to the Configuration | System | Events screen.
To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
To discard your settings, click Cancel. The Manager returns to the Configuration | System | Events screen.
This section of the Manager lets you add, configure, modify, and delete specific event classes for special handling. You can thus override the general, or default, handling of event classes. For example, you might want to send e-mail for HARDWAREMON events of severity 1 and 2, whereas default event handling does not send any e-mail.
Event classes denote the source of an event and refer to a specific hardware or software subsystem within the VPN Concentrator. Table 10-1 describes the event classes.
To configure default event handling, click the highlighted link that says "Click here to configure general event parameters."
The Configured Event Classes list shows the event classes that have been configured for special handling. The initial default entry is MIB2TRAP, which are SNMP MIB-II events, or "traps," that you might want to monitor with an SNMP network management system. Other configured event classes are listed in order by class number and name. If no classes have been configured for special handling, the list shows --Empty--.
To configure and add a new event class for special handling, click Add. See Configuration | System | Events | Classes | Add.
To modify an event class that has been configured for special handling, select the event class from the list and click Modify. See Configuration | System | Events | Classes | Modify.
To remove an event class that has been configured for special handling, select the event class from the list and click Delete.
|
Note There is no confirmation or undo. |
The Manager refreshes the screen and shows the remaining entries in the list.
The Manager immediately includes your changes in the active configuration. To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
If you chose Use Event List for any of the fields on the Configuration | System | Events | General screen, that default will appear for the same field on this screen. For example, if you chose Use Event List for the Events to Trap field on the Configuration | System | Events | General screen, the Events to Trap field on this screen defaults to Use Event List as well.
All subsequent parameters on this screen apply to this event class only.
Check the Enable check box to enable the special handling of this event class. (The box is checked by default.)
Unchecking this box lets you set up the parameters for the event class but activate it later, or temporarily disable special handling without deleting the entry. The Configured Event Classes list on the Configuration | System | Events | Classes screen indicates disabled event classes. Disabled event classes are handled in accordance with the default parameters for all event classes.
Click the Events to Log drop-down menu button and choose the range of event severity levels to enter in the event log. Choices are: None, Severity 1, Severities 1-2, Severities 1-3, ..., Severities 1-13, and Use Event List. The default is Severities 1-5. Using the default means that events of severity level 1 through severity level 5 are entered in the event log.
If you choose Use Event List, configure the Event List on the Configuration | System | Events screen to specify which of the particular events in this class you want to log. See Configuration | System | Events | General.
Click the Events to Console drop-down menu button and choose the range of event severity levels to display on the console. Choices are: None, Severity 1, Severities 1-2, Severities 1-3, ..., Severities 1-13, and Use Event List. The default is Severities 1-3. Using the default means that events of severity level 1 through severity level 3 are displayed on the console.
If you choose Use Event List, configure the Event List on the Configuration | System | Events page to specify which of the particular events in this class you want to display on the console. See Configuration | System | Events | General.
Click the Events to Syslog drop-down menu button and choose the range of event severity levels to send to a syslog server. Choices are: None, Severity 1, Severities 1-2, Severities 1-3, ..., Severities 1-13, and Use Event List. The default is None. Using the default means that no events are sent to a syslog server.
|
Note Sending events to a syslog server generates IP packets, which can generate new events if this setting is above level 9. We strongly recommend that you keep this setting at or below level 6. Avoid setting this parameter above level 9. |
If you select any severity levels to send, you must also configure the syslog server(s) on the Configuration | System | Events | Syslog Servers screens, and you should configure the Syslog Format on the Configuration | System | Events | General screen.
If you choose Use Event List, configure the Event List on the Configuration | System | Events page to specify which of the particular events in this class you want to send to the syslog server. See Configuration | System | Events | General.
Click the Events to E-mail drop-down menu button and choose the range of event severity levels to send to recipients via e-mail. The choices are: None, Severity 1, Severities 1-2, Severities 1-3, and Use Event List. The default is None: no events are sent via e-mail.
If you select any event severity levels to e-mail, you must also configure an SMTP server on the Configuration | System | Events | SMTP Servers screen, and you must configure e-mail recipients on the Configuration | System | Events | E-mail Recipients screens. You should also configure the E-mail Source Address on the Configuration | System | Events | General screen.
If you choose Use Event List, configure the Event List on the Configuration | System | Events page to specify which of the particular events in this class you want to send. See Configuration | System | Events | General.
Click the Events to Trap drop-down menu button and choose the range of event severity levels to send to an SNMP network management system. Event messages sent to SNMP systems are called "traps." The choices are: None, Severity 1, Severities 1-2, Severities 1-3, Severities 1-4, Severities 1-5, and Use Event List. The default is None. Using the default means that no events are sent as SNMP traps.
If you select any event severity levels to send, you must also configure SNMP destination system parameters on the Configuration | System | Events | Trap Destinations screens.
To configure "well-known" SNMP traps, see Table 10-4 under Events to Trap for Configuration | System | Events | General.
To add this event class to the list of those with special handling, click Add. Or to apply your changes to this configured event class, click Apply. Both actions include your entry in the active configuration. The Manager returns to the Configuration | System | Events | Classes screen. Any new event class appears in the Configured Event Classes list.
To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
To discard your settings, click Cancel. The Manager returns to the Configuration | System | Events | Classes screen.
This section of the Manager lets you configure SNMP network management systems as destinations of event traps. Event messages sent to SNMP systems are called "traps." If you configure any event handling—default or special—with values in Severity to Trap fields, you must configure trap destinations in this section.
To configure default event handling, click the highlighted link that says "Click here to configure general event parameters." To configure special event handling, see the Configuration | System | Events | Classes screens.
To configure well-known SNMP traps, see Table 10-4.
To have an SNMP-based network management system (NMS) receive any events, you must also configure the NMS to see the VPN Concentrator as a managed device or agent in the NMS domain.
The Trap Destinations list shows the SNMP network management systems that have been configured as destinations for event trap messages, and the SNMP protocol version associated with each destination. If no trap destinations have been configured, the list shows --Empty--.
To configure a new SNMP trap destination, click Add. See Configuration | System | Events | Trap Destinations | Add.
To modify an SNMP trap destination that has been configured, select the destination from the list and click Modify. See Configuration | System | Events | Trap Destinations | Modify.
To remove an SNMP trap destination that has been configured, select the destination from the list and click Delete.
|
Note There is no confirmation or undo. |
The Manager refreshes the screen and shows the remaining entries in the list.
The Manager immediately includes your changes in the active configuration. To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
Enter the IP address or host name of the SNMP network management system that is a destination for event trap messages. (If you have configured a DNS server, you can enter a host name; otherwise enter an IP address.)
Click the SNMP Version drop-down menu button and choose the SNMP protocol version to use when formatting traps to this destination. Choices are SNMPv1 (version 1; the default) and SNMPv2 (version 2).
Enter the community string to use in identifying traps from the VPN Concentrator to this destination. The community string is like a password: it validates messages between the VPN Concentrator and this NMS destination. If you leave this field blank, the default community string is public.
Enter the UDP port number by which you access the destination SNMP server. Use a decimal number from 0 to 65535. The default value is 162, which is the well-known port number for SNMP traps.
To add this system to the list of SNMP trap destinations, click Add. Or to apply your changes to this trap destination, click Apply. Both actions include your entry in the active configuration. The Manager returns to the Configuration | System | Events | Trap Destinations screen. Any new destination system appears in the Trap Destinations list.
To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
To discard your settings, click Cancel. The Manager returns to the Configuration | System | Events | Trap Destinations screen, and the Trap Destinations list is unchanged.
This section of the Manager lets you configure syslog servers as recipients of event messages. Syslog is a daemon, or background process, that records events. The VPN Concentrator can send event messages in two syslog formats to configured syslog systems. If you configure any event handling—default or special—with values in Severity to Syslog fields, you must configure syslog servers in this section.
To configure default event handling and syslog formats, click the highlighted link that says "Click here to configure general event parameters." To configure special event handling, see the Configuration | System | Events | Classes screens.
The Syslog Servers list shows the syslog servers that have been configured as recipients of event messages. You can configure a maximum of five syslog servers. If no syslog servers have been configured, the list shows --Empty--.
To configure a new syslog server, click Add. See Configuration | System | Events | Syslog Servers | Add.
To modify a syslog server that has been configured, select the server from the list and click Modify. See Configuration | System | Events | Syslog Servers | Modify.
To remove a syslog server that has been configured, select the server from the list and click Delete. There is no confirmation or undo. The Manager refreshes the screen and shows the remaining entries in the list.
The Manager immediately includes your changes in the active configuration. To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
Enter the IP address or host name of the syslog server to receive event messages. (If you have configured a DNS server, you can enter a host name; otherwise, enter an IP address.)
Enter the UDP port number by which you access the syslog server. Use a decimal number from 0 to 65535. The default value is 514, which is the well-known port number.
Click the Facility drop-down menu button and choose the syslog facility tag for events sent to this server. The facility tag lets the syslog server sort messages into different files or destinations. The choices are:
To add this server to the list of syslog servers, click Add. Or to apply your changes to this syslog server, click Apply. Both actions include your entry in the active configuration. The Manager returns to the Configuration | System | Events | Syslog Servers screen. Any new server appears in the Syslog Servers list.
To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
To discard your entries, click Cancel. The Manager returns to the Configuration | System | Events | Syslog Servers screen, and the Syslog Servers list is unchanged.
This section of the Manager lets you configure SMTP servers that you use to e-mail event messages to e-mail recipients. If you configure any event handling—default or special—with values in Severity to E-mail fields, you must identify at least one SMTP server to handle the outgoing e-mail, and you must name at least one e-mail recipient to receive the event messages. You can configure two SMTP servers: one primary and one backup in case the primary is unavailable.
To configure e-mail recipients, see the Configuration | System | Events | E-mail Recipients screen.
To configure default event handling, click the highlighted link that says "Click here to configure general event parameters." To configure special event handling, see the Configuration | System | Events | Classes screens.
The SMTP Servers list shows the configured SMTP servers in the order in which the system accesses them. You can configure two prioritized SMTP servers so that you have a backup server in case the primary server is offline, congested, etc. If no SMTP servers have been configured, the list shows --Empty--.
To configure a new SMTP server, click Add. See Configuration | System | Events | SMTP Servers | Add.
To modify a configured SMTP server, select the server from the list and click Modify. See Configuration | System | Events | SMTP Servers | Modify.
To remove a configured SMTP server, select the server from the list and click Delete.
|
Note There is no confirmation or undo. |
The Manager refreshes the screen and shows the remaining entries in the SMTP Servers list.
To change the order in which the system accesses configured SMTP servers, select the server from the list and click Move [Up Arrow] or Move [Down Arrow]. The Manager refreshes the screen and shows the reordered SMTP Servers list.
The Manager immediately includes your changes in the active configuration. To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
Enter the IP address or host name of the SMTP server. (If you have configured a DNS server, you can enter a host name; otherwise, enter an IP address.)
To add this server to the list of SMTP servers, click Add. Or to apply your changes to this SMTP server, click Apply. Both actions include your entry in the active configuration. The Manager returns to the Configuration | System | Events | SMTP Servers screen. Any new server appears in the SMTP Servers list.
To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
To discard your entry, click Cancel. The Manager returns to the Configuration | System | Events | SMTP Servers screen, and the SMTP Servers list is unchanged.
This section of the Manager lets you configure e-mail recipients of event messages. You can configure a maximum of five e-mail recipients, and you can customize the event message severity levels for each recipient.
If you configure any event handling (either default or special) with values in Severity to E-mail fields, you must name at least one e-mail recipient to receive the event messages, and you must identify at least one SMTP server to handle the outgoing e-mail. You should also configure the E-mail Source Address on the Configuration | System | Events | General screen.
To configure SMTP servers, see the Configuration | System | Events | SMTP Servers screen, or click the highlighted link that says "configure an SMTP server."
To configure default event handling, click the highlighted link that says "Click here to configure general event parameters." To configure special event handling, see the Configuration | System | Events | Classes screens.
The E-mail Recipients list shows configured event message e-mail recipients in the order they were configured. You can configure a maximum of five e-mail recipients. If no e-mail recipients have been configured, the list shows --Empty--.
To configure a new e-mail recipient, click Add. See Configuration | System | Events | E-mail Recipients | Add.
To modify an e-mail recipient who has been configured, select the recipient from the list and click Modify. See Configuration | System | Events | E-mail Recipients | Modify.
To remove an e-mail recipient who has been configured, select the recipient from the list and click Delete.
|
Note There is no confirmation or undo. |
The Manager refreshes the screen and shows the remaining recipients in the E-mail Recipients list.
The Manager immediately includes your changes in the active configuration. To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
Enter the recipient's complete e-mail address, for example: cisco@cisco.com.
Click the Max Severity drop-down menu button and choose the range of event severity levels to send to this recipient via e-mail. The choices are: None, 1, 1-2, 1-3. The default value is 1-3: configured events of severity level 1 through severity level 3 are sent to this recipient.
The event levels e-mailed to this recipient are the lesser of the Severity to E-mail setting for a customized event class, or this Max Severity setting. If an event class has not been customized, the events e-mailed are the lesser of this setting or the default Severity to E-mail setting. For example, if you configure IPSEC events with severity levels 1-3 to e-mail, all other events with no severity to e-mail, and cisco@cisco.com to receive e-mail events of severity levels 1-2, cisco will receive only IPSEC events of severity levels 1-2.
To add this recipient to the list of e-mail recipients, click Add. Or to apply your changes to this e-mail recipient, click Apply. Both actions include your entry in the active configuration. The Manager returns to the Configuration | System | Events | E-mail Recipients screen. Any new recipient appears at the bottom of the E-mail Recipients list.
To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window. To discard your entry, click Cancel. The Manager returns to the Configuration | System | Events | E-mail Recipients screen, and the E-mail Recipients list is unchanged.
Posted: Wed Jul 16 12:40:01 PDT 2003
All contents are Copyright © 1992--2003 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.
