Ciscoworks... and big log files.

Hey techies... especially those of you using CW:

On an ongoing basis I find the syslog and jrm log files getting huge, and eating up large chunks of disk space. Just this morning, I had to delete a 300Mb jrm file and a 5Gb syslog file.

The recommendation from cisco is to delete them...
https://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_ip_communications_service_monitor/1.0/user/guide/adminqov.html

Note this process:

net stop crmlog
net stop crmdmgtd

delete syslog.log

net start crmlog
net start crmdmgdt

I'm not really partial to deleting the entire syslog and jrm log files... anyone got a better process? Any way to cycle the log files within CW that I don't know about?

Much obliged,
Mike

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

Forsaken_GA

If it will allow you to do so, sending your logs to a unix based syslog server that will do proper log rotation is what I'd opt for, then you won't have to worry about the logs on the CW machine.

mikearama

That works if CW is installed on a Unix system. Our company opted for the Windows version of the software, and it doesn't allow the forwarding of syslogs off-system.

Forsaken_GA

mikearama wrote: »

That works if CW is installed on a Unix system. Our company opted for the Windows version of the software, and it doesn't allow the forwarding of syslogs off-system.

Yeah, I've never dealt with CiscoWorks in a production environment, kinda retarded that it won't let you forward them offbox.

Well, the other easy option is to script your own log rotations. I'm assuming that 5 gig syslog isn't from one days worth of activity. You should be able to write a simple batch file that will perform the steps for you, just add in some lines to rotate your log files, compress the current one, and then delete it and restart the services. Set it up to run once a day, and your disk space issues will hopefully go away

AutoBahn81

CW is great for live monitoring, I am running it on my network. But for configuration and change management...NCM is the way to go. A lot of IT guys I've talked to don't even know about it either. It is seriously one of the greatest management tools EVER! We also have the CiscoWorks Connector so that it is connected (hence the name) to CW 24/7. As far as large files, I've got automatic file pruning configured on NCM which is tuned based on what the data is whether it be configuration files, task history, IOS images, etc...