Cisco IOS Cookbook, 2nd Edition

Modifying Log Messages

Problem

You wish to change the default attributes of particular system-generated log messages.

Solution

In order to modify system log messages, you must configure the Embedded Syslog Manager (ESM) by using a combination of configuration commands and TCL scripts. First you must write a TCL script to perform a certain task and make it available via TFTP. In this simple example, the TCL script in Example 18-3 filters out a particular system log message (clear counters) and permits all other messages to be forwarded as normal.

Example 18-3. delcounters.tcl

# delcounters.tcl – This script deletes all log messages that
#                   have the mnemonic "COUNTERS". 
if { [string compare -nocase COUNTERS $::mnemonic ] == 0 } {
return ""
} else {
return $::orig_msg
}

Now we must configure the router to retrieve the TCL script we’ve just created and implement it:

Router2#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router2(config)#logging filter tftp://172.25.1.1/delcounters.tcl
Router2(config)#logging host 172.25.1.1 filtered
Router2(config)#end
Router2#

Discussion

The ESM was introduced in IOS Version 12.3(2)T, and it provides a programmable interface that allows you to filter, escalate, correlate, route, and customize system logging messages. The ESM allows you full control of system log messages via Tool Command Language-based (TCL) scripts, which can be stored locally or remotely.

In our example, we configured the router to delete all “clear counters” ...