Configure Cisco router to send syslog messages to syslog server

I needed to configure some Cisco routers to send syslog messages to a syslog server; here is how I did it.

Two things to note;

1. 192.168.5.190 is the IP address of the syslog server you are sending the messages to.

2. I was not receiving messages from the remote routers; after some troubleshooting I discovered I needed to tell the remote routers what interface to send the message out on. In my case is was BVI1.

A quick way to test connectivity from the router is with the ping command specifying the source interface.

router#ping 192.168.5.190 source BVI1

Here are the configuration steps

router#
router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
router(config)#logging 192.168.5.190
router(config)#service sequence-numbers
router(config)#service timestamps debug datetime localtime show-timezone
router(config)#service timestamps log datetime localtime show-timezone msec
router(config)#logging facility local3
router(config)#logging trap informational
router(config)#logging buffered 1000000
router(config)#no logging console
router(config)#no logging monitor
router(config)#default logging rate-limit
router(config)#default logging queue-limit
router(config)#logging source-interface BVI1
router(config)#exit
router#sh logging
Syslog logging: enabled (0 messages dropped, 5 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

Console logging: disabled
Monitor logging: disabled
Buffer logging: level debugging, 25 messages logged, xml disabled,
filtering disabled
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled

No active filter modules.

Trap logging: level informational, 353 message lines logged
Logging to 192.168.5.190 (udp port 514, audit disabled,
link up),
353 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging Source-Interface: VRF Name:
BVI1

Log Buffer (1000000 bytes):

router#

source articles
https://supportforums.cisco.com/docs/DOC-16310#config
https://supportforums.cisco.com/thread/2188315
http://www.ciscopress.com/articles/article.asp?p=426638&seqNum=3

By • Cisco • 0

upgrade IOS on a Cisco router

Today one job is to upgrade the IOS image on a Cisco 1801 router. To achieve this you will need the IOS image and a tftp server to load the image from.

Here is a free one; http://tftpd32.jounin.net/

1. Download the new image from Cisco. You will need a CCO login (get a smartnet contract to get access).

The IOS image I am using today is; c180x-advipservicesk9-mz.151-4.M5.bin

2. Check that the flash memory on the router has enough space for the new image.

router#sh flash
-#- –length– —–date/time—— path
1 23700004 Jan 30 2012 01:53:22 +00:00 c180x-advipservicesk9-mz.124-24.T5.bin
2 1505280 Jan 30 2012 01:54:08 +00:00 COMMON.TAR
3 931840 Jan 30 2012 01:53:44 +00:00 ES.TAR
4 1038 Jan 30 2012 01:54:38 +00:00 home.shtml
5 112640 Jan 30 2012 01:54:54 +00:00 HOME.TAR
6 3407 Jan 30 2012 01:55:08 +00:00 sdmconfig-180x.cfg
7 2242560 Jan 30 2012 01:56:56 +00:00 WLANUI.TAR
8 217763 Dec 15 2012 15:00:46 +00:00 crashinfo_20121215-150047
9 4 Jan 5 2013 21:14:20 +00:00 FOC100128ZR

69806080 bytes available (58302464 bytes used)

You can see above there is about 69MB available; the image I am using is a little over 28MB

3.  Check your router has the required memory (check the requirement for the IOS when downloading).

router#sh ver

Cisco 1801W (MPC8500) processor (revision 0x400) with 354304K/38912K bytes of memory.
Processor board ID FCZ100521WB, with hardware revision 0000

4. TFTP the new image to the router

router#copy tftp flash
Address or name of remote host []? 192.168.41.59
Source filename []? c180x-advipservicesk9-mz.151-4.M5.bin
Destination filename [c180x-advipservicesk9-mz.151-4.M5.bin]?
Accessing tftp://192.168.41.59/c180x-advipservicesk9-mz.151-4.M5.bin…

5. Tell the router what image to boot from.

router#configure terminal
router(config)#
router(config)#boot system flash c180x-advipservicesk9-mz.151-4.M5.bin
router(config)#exit

6. Save the changes and restart the router

router#wr
Building configuration…
[OK]

router#reload
Proceed with reload? [confirm]

done!

By • Cisco • 0

Check if program is running

I was having trouble with my solar monitoring software closing down at random for no apparent reason every three to seven days, I was unable to find any pattern to this behavior.

To solve the problem I scheduled this vbscript to run every hour. I did not write it from scratch, I used examples to get the result you see here. The script looks for the program by name and starts the program if it’s not running. I have changed the script to notepad.exe for testing, change it to whatever your program name is.

The program I am using is SG-View.exe from solar-guppy. My solar hardware consists of 16 x 185 watt panels, a Xantrex T 2.8 inverter and an old laptop with a serial port. SG-View.exe is the program that collects the data from the inverter. The data is then uploaded to pvoutput.org.

There are some lines you will want to comment out once you are sure its working, like this message box Msgbox(“Notepad is not running, I will start it now”) it is only there for testing (put a ‘ in front of the line to comment it out).


'Msgbox("Notepad is not running, I will start it now")

Copy this code, open notepad paste it and save it as filename.vbs where filename is what ever you want to call it.

'Check if a program is running, if not run it.
Set WshShell = WScript.CreateObject ("WScript.Shell")
Set colProcessList = GetObject("Winmgmts:").ExecQuery ("Select * from Win32_Process")
'==============================================================================================
For Each objProcess in colProcessList
If objProcess.name = "notepad.exe" then
vFound = True
End if
Next
If vFound = True then
'WshShell.Run ("C:\Windows\system32\cmd.exe")
'Add sleep if needed
wscript.sleep 50
'send keys and kill taskin needed
'WshShell.sendkeys "taskkill /IM notepad.exe"
'wscript.sleep 50
'WshShell.SendKeys "{ENTER}"
Msgbox("Notepad It is already running, nothing to do")
Else
Msgbox("Notepad is not running, I will start it now")

sub shell(cmd)
' Run a command as if you were running from the command line
 dim objShell
 Set objShell = WScript.CreateObject( "WScript.Shell" )
 objShell.Run(cmd)
 Set objShell = Nothing
end sub

shell "notepad.exe"

End If

By • Scripting, Solar • 0

VMWare change failed network management adapter

We experienced an unusual fault today, it started out with remote users complaining about voice quality from their Cisco IP phone and remote desktop was dropping out. At first I thought it was a network problem as the users connect via a Cisco router IPsec VPN.

While I was checking the main router, local users started complaining about voice quality,  which changed my focus to the pbx (Asterisk running on Linux). I connected an IP phone directly to the pbx and voice quality as good so I moved onto the switches. I noticed port 20 was intermittently changing between amber and green so I removed the cable and all the problems disappeared. I could replicate the problem on any port so it was not the switch.

I traced the network cable back to our VMWare hosts first network adapter which is assigned to the Management Network.  Now I needed remove the faulty one and assign another adapter to the management network.

Here is how I did it, I hope this helps someone else.

1. I logged in to the VMWare host console via the IBM Integrated Management Module KVM (you may have some other connection method)

2. Select Configure Management Network and pres enter

3. Select Network adapters and press enter

4. Un-check the faulty one by highlighting it and pressing the spacebar

5. Select the one you want to use and press the space bar

6. I received this warning message, this did not concern me as I knew the adapter was not assigned to any guest so I pressed enter.

7.  This part of the following message did concern me “In case IPv6 has been enabled or disabled this will restart you host”. I did not find this very clear, I am not using IPv6, will it restart my host? To be safe shutdown your virtual machines first. My VMWare host did not restart and all was ok.

Now I can call IBM and get them to replace the Network adapter

By • IT, VMWare • 0

Combine multiple squid access.log files

We have squid cache / proxy running on a number of Windows servers in diffident geographical locations with the access.log file on the local server in each location. The problem was our reporting software LightSquid was in one location and needed a single access.log file.

To solve this problem I created a simple script and scheduled it to run every hour. The script collects the remote access.log files and combines them into one access.log then uploads the access.log to the Linux box running LightSquid for processing.

Here are the contents of the two files cp.bat (schedule this one to run hourly) and squid.ftp, create a folder called c:\AccessLogCP and put the two files in it.

Contents of cp.bat (change the server and folders names suite your setup)

::Copy squid log files from remote systems
copy \\srv01\c$\squid\var\logs\access.log c:\AccessLogCP\srv01.txt
copy \\srv02\c$\squid\var\logs\access.log c:\AccessLogCP\srv02.txt

::Delete old access.log file
del /Q access.log

::Combine or pipe the contents of all files that end in txt to access.log
type *.txt >> access.log

::Delete the txt files as we are finished with them
del /Q *.txt

::FTP access.log to lihtsquid for processing
c:\windows\system32\ftp.exe -s:squid.ftp

exit

Contents of squid.ftp (change, yourftp, yourusername and yourpassword names suite your setup)

open yourftp
yourusername
yourpassword
ascii
put
c:\AccessLogCP\access.log
/var/log/squid/access.log
quit

By • IT, Squid • 0 • Tags:

Hidden network adapters

I received this error when changing a TCP/IP settings on a VMware virtual machine that was converted from a physical to a virtual machine.

The IP address you entered for this network adapter is already assigned to another adapter.

You may also get this message; Cannot rename this connection. A connection with the name you specified already exists. Specify a different name.

The problem is a hidden network adapter with the same connection name or TCP/IP setting.

This is how I fixed it;

1. Click Start, click Run, type cmd.exe, and then press ENTER.
2. Type set devmgr_show_nonpresent_devices=1, and then press ENTER.
3. Type Start DEVMGMT.MSC, and then press ENTER.

4. Click View, and then click Show Hidden Devices.
5. Expand the Network Adapters tree.
6. Right-click the dimmed network adapter, and then click Uninstall.

By • IT, VMWare • 1

1 2 3 4 5