|
|
An event is any significant occurrence within or affecting the VPN 3002 such as an alarm, trap, error condition, network problem, task completion, threshold breach, or status change. The VPN 3002 records events in an event log, which is stored in nonvolatile memory. You can also specify that certain events trigger a console message, a UNIX syslog record, or an SNMP management system trap.
Event attributes include class and severity level.
Event class denotes the source of the event and refers to a specific hardware or software subsystem within the VPN 3002.Table 9-1 describes the event classes.
 |
Note The Cisco-specific event classes provide information that is meaningful only to Cisco engineering or
support personnel. Also, the DBG and DECODE events require significant system resources and may
seriously degrade performance. We recommend that you avoid logging these events unless Cisco
requests it.
|
Severity level indicates how serious or significant the event is; i.e., how likely it is to cause unstable operation of the VPN 3002, whether it represents a high-level or low-level operation, or whether it returns little or great detail. Level 1 is most significant.Table 9-2 describes the severity levels.
Within a severity level category, higher-numbered events provide more details than lower-numbered events, without necessarily duplicating the lower-level details. For example, within the Information category, Level 6 provides greater detail than Level 4 but doesn't necessarily include the same information as Level 4.
Logging higher-numbered severity levels degrades performance, since more system resources are used to log and handle these events.
|
Note The Debug (7-9) and Packet Decode (10-13) severity levels are intended for use by Cisco engineering and support personnel. We recommend that you avoid logging these events unless Cisco requests it. |
The VPN 3002, by default, displays all events of severity level 1 through 3 on the console. It writes all events of severity level 1 through 5 to the event log. You can change these defaults on the Configuration | System | Events | General screen, and you can configure specific events for special handling on the Configuration | System | Events | Classes screens.
The VPN 3002 records events in an event log, which is stored in nonvolatile memory. Thus the event log persists even if the system is powered off. For troubleshooting any system difficulty, or just to examine details of system activity, consult the event log first.
The VPN 3002 holds 256 events. The log wraps when it is full; that is, newer events overwrite older events when the log is full.
For the event log, you can configure which event classes and severity levels to log.
Each entry (record) in the event log consists of several fields including:
For more information, see the Monitoring | Filterable Event Log screen.
This section of the Manager lets you configure how the VPN 3002 handles events. Events provide information for system monitoring, auditing, management, accounting, and troubleshooting.
This Manager screen lets you configure the general, or default, handling of all events. These defaults apply to all event classes.
You can override these default settings by configuring specific events for special handling on the Configuration | System | Events | Classes screens.
Click the drop-down menu button and select the format for all events sent to UNIX syslog servers. Choices are:
Click the drop-down menu button and select the range of event severity levels to enter in the event log by default. Choices are: None, 1, 1-2, 1-3, ..., 1-13. The default is 1-5: all events of severity level 1 through severity level 5 are entered in the event log.
Click the drop-down menu button and select the range of event severity levels to display on the console by default. Choices are: None, 1, 1-2, 1-3, ..., 1-13. The default is 1-3: all events of severity level 1 through severity level 3 are displayed on the console.
Click the drop-down menu button and select the range of event severity levels to send to a UNIX syslog server by default. Choices are: None, 1, 1-2, 1-3, ..., 1-6. The default is None: no events are sent to a syslog server.
If you select any severity levels to send, you must also configure the syslog server(s) on the Configuration | System | Events | Syslog Servers screens.
Click the drop-down menu button and select the range of event severity levels to send to an SNMP network management system by default. Event messages sent to SNMP systems are called "traps." Choices are: : None, 1, 1-2, 1-3. The default is None: no events are sent as SNMP traps.
If you select any severity levels to send, you must also configure SNMP destination system parameters on the Configuration | System | Events | Trap Destinations screens.
The VPN 3002 can send the standard, or "well-known," SNMP traps listed in Table 9-3. To have an SNMP NMS receive them, you must configure the events as in the table, and configure a trap destination.
To include your settings for default event handling in the active configuration, click Apply. The Manager returns to the Configuration | System | Events screen.
To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
To discard your settings, click Cancel. The Manager returns to the Configuration | System | Events screen.
This section of the Manager lets you add, configure, modify, and delete specific event classes for special handling. You can thus override the general, or default, handling of event classes. For example, you might want to send email for HARDWAREMON events of severity 1-2, whereas default event handling doesn't send any email.
Event classes denote the source of an event and refer to a specific hardware or software subsystem within the VPN 3002.Table 9-1 describes the event classes.
To configure default event handling, click the highlighted link that says "Click here to configure general event parameters."
The Configured Event Classes list shows the event classes that have been configured for special handling. The initial default entry is MIB2TRAP, which are SNMP MIB-II events, or "traps," that you might want to monitor with an SNMP network management system. Other configured event classes are listed in order by class number and name. If no classes have been configured for special handling, the list shows --Empty--.
To configure and add a new event class for special handling, click Add. See Configuration | System | Events | Classes | Add.
To modify an event class that has been configured for special handling, select the event class from the list and click Modify. See Configuration | System | Events | Classes | Modify.
To remove an event class that has been configured for special handling, select the event class from the list and click Delete. There is no confirmation or undo. The Manager refreshes the screen and shows the remaining entries in the list.
The Manager immediately includes your changes in the active configuration. To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
These screens let you:
Add screen:
Modify screen:
All subsequent parameters on this screen apply to this event class only.
Check this box to enable the special handling of this event class. (The box is checked by default.)
Clearing this box lets you set up the parameters for the event class but activate it later, or temporarily disable special handling without deleting the entry. The Configured Event Classes list on the Configuration | System | Events | Classes screen indicates disabled event classes. Disabled event classes are handled according to the default parameters for all event classes.
Click the drop-down menu button and select the range of event severity levels to enter in the event log. Choices are: None, 1, 1-2, 1-3,..., 1-13. The default is 1-5: events of severity level 1 through severity level 5 are entered in the event log.
Click the drop-down menu button and select the range of event severity levels to display on the console. Choices are: None, 1, 1-2, 1-3,..., 1-13. The default is 1-3: events of severity level 1 through severity level 3 are displayed on the console.
Click the drop-down menu button and select the range of event severity levels to send to a UNIX syslog server. Choices are: None, 1, 1-2, 1-3,..., 1-13. The default is None: no events are sent to a syslog server.
|
Note Sending events to a syslog server generates IP packets, which can generate new events if this setting is above level 9. We strongly recommend that you keep this setting at or below level 6. Avoid setting this parameter above level 9. |
If you select any severity levels to send, you must also configure the syslog server(s) on the Configuration | System | Events | Syslog Servers screens, and you should configure the Syslog Format on the Configuration | System | Events | General screen.
Click the drop-down menu button and select the range of event severity levels to send to an SNMP network management system. Event messages sent to SNMP systems are called "traps." Choices are: None, 1, 1-2, 1-3, 1-4, 1-5. The default is None: no events are sent as SNMP traps.
If you select any severity levels to send, you must also configure SNMP destination system parameters on the Configuration | System | Events | Trap Destinations screens.
To configure "well-known" SNMP traps, seeTable 9-3 under Severity to Trap for Configuration | System | Events | General.
To add this event class to the list of those with special handling, click Add. Or to apply your changes to this configured event class, click Apply. Both actions include your entry in the active configuration. The Manager returns to the Configuration | System | Events | Classes screen. Any new event class appears in the Configured Event Classes list.
To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
To discard your settings, click Cancel. The Manager returns to the Configuration | System | Events | Classes screen.
This section of the Manager lets you configure SNMP network management systems as destinations of event traps. Event messages sent to SNMP systems are called "traps." If you configure any event handling—default or special—with values in Severity to Trap fields, you must configure trap destinations in this section.
To configure default event handling, click the highlighted link that says "Click here to configure general event parameters." To configure special event handling, see the Configuration | System | Events | Classes screens.
To configure "well-known" SNMP traps, seeTable 9-3 under Severity to Trap for Configuration | System | Events | General.
To have an SNMP-based network management system (NMS) receive any events, you must also configure the NMS to "see" the VPN 3002 as a managed device or "agent" in the NMS domain.
The Trap Destinations list shows the SNMP network management systems that have been configured as destinations for event trap messages, and the SNMP protocol version associated with each destination. If no trap destinations have been configured, the list shows --Empty--.
To configure a new SNMP trap destination, click Add. See Configuration | System | Events | Trap Destinations | Add.
To modify an SNMP trap destination that has been configured, select the destination from the list and click Modify. See Configuration | System | Events | Trap Destinations | Modify.
To remove an SNMP trap destination that has been configured, select the destination from the list and click Delete. There is no confirmation or undo. The Manager refreshes the screen and shows the remaining entries in the list.
The Manager immediately includes your changes in the active configuration. To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
These screens let you:
Enter the IP address or hostname of the SNMP network management system that is a destination for event trap messages. (If you have configured a DNS server, you can enter a hostname; otherwise enter an IP address.)
Click the drop-down menu button and select the SNMP protocol version to use when formatting traps to this destination. Choices are SNMPv1 (version 1; the default) and SNMPv2 (version 2).
Enter the community string to use in identifying traps from the VPN 3002 to this destination. The community string is like a password: it validates messages between the VPN 3002 and this NMS destination. If you leave this field blank, the default community string is public.
Enter the UDP port number by which you access the destination SNMP server. Use a decimal number from 0 to 65535. The default is 162, which is the well-known port number for SNMP traps.
To add this system to the list of SNMP trap destinations, click Add. Or to apply your changes to this trap destination, click Apply. Both actions include your entry in the active configuration. The Manager returns to the Configuration | System | Events | Trap Destinations screen. Any new destination system appears in the Trap Destinations list.
To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
To discard your settings, click Cancel. The Manager returns to the Configuration | System | Events | Trap Destinations screen, and the Trap Destinations list is unchanged.
This section of the Manager lets you configure UNIX syslog servers as recipients of event messages. Syslog is a UNIX daemon, or background process, that records events. The VPN 3002 can send event messages in two syslog formats to configured syslog systems. If you configure any event handling—default or special—with values in Severity to Syslog fields, you must configure syslog servers in this section.
To configure default event handling and syslog formats, click the highlighted link that says "Click here to configure general event parameters." To configure special event handling, see the Configuration | System | Events | Classes screens.
The Syslog Servers list shows the UNIX syslog servers that have been configured as recipients of event messages. You can configure a maximum of five syslog servers. If no syslog servers have been configured, the list shows --Empty--.
To configure a new syslog server, click Add. See Configuration | System | Events | Syslog Servers | Add.
To modify a syslog server that has been configured, select the server from the list and click Modify. See Configuration | System | Events | Syslog Servers | Modify.
To remove a syslog server that has been configured, select the server from the list and click Delete. There is no confirmation or undo. The Manager refreshes the screen and shows the remaining entries in the list.
The Manager immediately includes your changes in the active configuration. To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
These screens let you:
Enter the IP address or hostname of the UNIX syslog server to receive event messages. (If you have configured a DNS server, you can enter a hostname; otherwise, enter an IP address.)
Enter the UDP port number by which you access the syslog server. Use a decimal number from 0 to 65535. The default is 514, which is the well-known port number.
Click the drop-down menu button and select the syslog facility tag for events sent to this server. The facility tag lets the syslog server sort messages into different files or destinations. The choices are:
To add this server to the list of syslog servers, click Add. Or to apply your changes to this syslog server, click Apply. Both actions include your entry in the active configuration. The Manager returns to the Configuration | System | Events | Syslog Servers screen. Any new server appears in the Syslog Servers list.
To save the active configuration and make it the boot configuration, click the Save Needed icon at the top of the Manager window.
To discard your entries, click Cancel. The Manager returns to the Configuration | System | Events | Syslog Servers screen, and the Syslog Servers list is unchanged.
Posted: Tue Nov 19 15:14:23 PST 2002
Copyright 1989-2000©Cisco Systems Inc.