IBM SC30-3681-08 manual Using and Conguring ELS Remote Logging, Syslog Facility and Level

Using ELS

Using and Con®guring ELS Remote Logging

The remotely-logged ELS message contains all of the information that is contained in ELS messages found in the monitor queue, as viewed under talk 2, and also contains additional information as shown in Figure 5.

Date/Time	IP address	Sequence Number	Local Name	ELS Subsystem	Name, &
	assigned	used for detecting	assigned	Formatted message
	by the user	missing messages	by the user
Nov 20 12:13:47	5.1.1.1	Msg [0444] from	** IBM/2210 **	:els: ARP.011	Del ent ...

Figure 5. Syslog Message Description

Note the following differences in the remote log display:

vThe month and day of month in addition to the time, which is always displayed as the time-of-day.

vAn IP address, which is the user-speci®ed source IP address. If a DNS server resolves the source IP address to a hostname, then the hostname will be displayed instead of the IP address.

vA Sequence number is added to the message by the source device to assist in detecting dropped messages. See ªRemote Logging Outputº on page 159 for an explanation of dropped messages. When the sequence number of the message reaches 9999, the next sequence number is 0001.

vA ªLocal Nameº for the source router, to assist in distinguishing between messages from multiple sources. If you do not con®gure a local name, this ®eld is blank.

Syslog Facility and Level

Remotely-logged ELS messages are transmitted over the network in UDP packets with the destination port number in the UDP header always equal to 514, the syslog port. To receive and process the UDP packets, the syslog daemon (syslogd) must be running in the remote workstation that is receiving and logging the ELS messages. See ªRemote Workstation Con®gurationº for details.

Although it is not displayed in the remotely-logged ELS message, every ELS message sent on the network in a UDP packet must be assigned a syslog_facility and a syslog_level. The syslog daemon uses the combination of facility and level to determine where to route the message. Typically, you want the ELS messages to be written to one or more ®les in the remote host. Other options include displaying the message on the console, sending the message to one or more users, or sending the message to another workstation.

The commands you use to specify the syslog_facility and syslog_level values, along with other remote-logging related console commands, are described in ªELS Monitoring Commandsº on page 188 and ªELS Con®guration Commandsº on page 167 . Review these commands before reading through the next section.

Remote Workstation Con®guration

The following con®guration assumes that a single 2210 is remote-logging to a single remote workstation. You can con®gure multiple 2210s to remote-log to the same

Chapter 12. Using the Event Logging System (ELS) 155