topic Re: Centralize Log Viewers/Analyzers in ZoneDirector

Centralize Log Viewers/Analyzers

robert_sobelman — Fri, 06 Jun 2014 18:03:58 GMT

What centralized log viewers/analyzers is ZoneDirector compatible with? Is anyone using a centralize log server/analyzer (e.g. logrythms)?

Re: Centralize Log Viewers/Analyzers

max_o_driscoll — Mon, 09 Jun 2014 08:58:40 GMT

Syslog Watcher Personal Edition 2.8 (cheap ie free like me).
http://www.snmpsoft.com/

Not so much a recommendation more that it works, is simple, didn't need some monstous SQL backend or some obtuse version of dotnet to install. That's fitted my scenario.

Gives me very basic syslog info/reporting. Enough for me but you might prefer something cleaner and with more bells/whistles/pan pies.

Doesn't interpret the cryptic ruckus message codes but I wasn't expecting an easy life!

Re: Centralize Log Viewers/Analyzers

mulyantan_t — Wed, 15 Oct 2014 08:36:24 GMT

i already installed syslog watcher and configure-system: Log Settings, checked enable reporting to remote syslog server at (my ip windows : 192.168.10.99)

what is the next step?

Re: Centralize Log Viewers/Analyzers

max_o_driscoll — Wed, 15 Oct 2014 12:05:10 GMT

In ZD go to
system
log settings
TICK enable reporting to remote syslog server ADD IP of syslog server.

In syslog
settings
network
TICK accept messages over UDP on port number 514 (should be default).

Re: Centralize Log Viewers/Analyzers

max_o_driscoll — Wed, 15 Oct 2014 12:09:06 GMT

Don't get confused...

syslog watcher runs on machine with specific IP and listens for incoming traffic on 514

you tell ZD to send syslog traffic to that specific IP.

The rest is histoire.

.

Re: Centralize Log Viewers/Analyzers

mulyantan_t — Thu, 16 Oct 2014 08:43:19 GMT

thank you, done

Re: Centralize Log Viewers/Analyzers

max_o_driscoll — Thu, 16 Oct 2014 09:00:26 GMT

Point ZD at syslog machines IP.

The IP you first mentioned (my ip windows : 192.168.10.99) is not what you have put in your screenshot.

Back to "do not get confused".

IP of machine running syslog watcher must be the one you enter into the ZD config page.

Basic stuff: on syslog watcher pc
start run cmd... ipconfig to find your ip

while in cmd prompt check you can ping ZD from syslog watcher pc.

Are they in same subnet (if not they will not see each other...unless you put some routing rules in or play with masks...shouldn't be necessary).

Have fun.

Re: Centralize Log Viewers/Analyzers

greg_ashe — Thu, 16 Oct 2014 16:19:37 GMT

My curiousity got the better of me and I set up the syslog server. There are many ERRORs being logged - the majority of them to do with acsrvc_receive() message.

Any ideas what this means, the cause and the cure?

Re: Centralize Log Viewers/Analyzers

greg_ashe — Thu, 16 Oct 2014 16:48:53 GMT

Well in fact - despite being flagged as an ERROR it seems it is benign enough!

When a client roams from AP1 to AP2 then AP1 will send a log message as shown below.

acsrvc_receive():88:32:9b:aa:a1:88 station of VAP c0:8a:de:3c:e0:e8, last stats reported from unmatched VAP c0:8a:de:38:86:08

This log can simply be ignored as this is not harmful.

Perhaps Ruckus should re-classify this as an INFO alert instead of ERROR