Set Up Syslog

The logging feature gives administrators a way to centrally log and analyze configuration events and system error messages. For example, if you are using RADIUS authentication, each failed login attempt will be sent to the defined Syslog server.

Syslog can be used in conjunction with the adaptive response and user events feature. For example, when you register an event, you will be asked if you want to send events to Syslog; you can define and register an event that sends a message to a Syslog server when retransmissions rise to 30 percent of your network activity.

To set up logging, you need to:

1. Define one or more Syslog servers.

2. Enable the logging feature.

Define the Syslog Server

To define a Syslog server, use the setup syslog add command from the command-line interface as described below. You can add up to four Syslog servers.

To define a Syslog server:

1. Access the CLI.

2. At the command-line prompt, use the following command:

setup syslog add host:<ipaddress> [output:<facility>,<level>] [port:<portnum>] [datetime]


For example:

setup syslog add host:10.7.38.100 output:local4,3 datetime

Facility Types

You can enter the keyword or value specified in the following table.

Severity Levels

You can enter the keyword or value specified in the following table. Set the level to specify which messages to suppress to the Syslog server. For example, setting the severity level to 3 allows messages with levels 0 - 3 and suppresses messages with levels 4 - 7. If you don't specify a severity level, 7 is used. With the default severity level, messages of all levels will get sent to the Syslog server.

At the "warn" level, Packeteer will send the following types of messages to the Syslog server:

• Login failed
• Hard drive status
• Measurement Engine status
• Direct standby status
• Plug-in status

See Packeteer Syslog Warn Messages for a list of these messages.

User events that are configured to send a syslog message when a threshold is crossed are sent at the info severity level (6). See event register for more information on configuring an event to send a syslog message.

Adaptive response action files that include the send syslog command can designate the severity level at which the message is sent to the Syslog server; any level can be specified.

Enable the Logging Feature

To enable the logging feature so that messages will be sent to the defined Syslog server(s), type the following command at the command-line prompt:

setup syslog on

To check whether the logging feature is on or off, use the setup syslog show command.