Cisco Acs 5x User Guide

19-5
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 19      Understanding Logging
  About Logging
Local Store Target
Log messages in the local store are text files that are sent to one log file, located at 
/opt/CSCOacs/logs/localStore/, regardless of which logging category they belong to. The local store can 
only contain log messages from the local ACS node; the local store cannot accept log messages from 
other ACS nodes.
You can configure which logs are sent to the local...

19-6
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 19      Understanding Logging
  About Logging
Table 19-2 Local Store and Syslog Message Format
Field Description
timestampDate of the message generation, according to the local clock of the 
originating ACS, in the format YYYY- MM-DD hh:mm:ss:xxx +/-zh:zm. 
Possible values are:
YYYY = Numeric representation of the year.
MM = Numeric representation of the month. For single-digit months (1 
to 9) a zero precedes the number.
DD =...

19-7
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 19      Understanding Logging
  About Logging
You can use the web interface to configure the number of days to retain local store log files; however, 
the default setting is to purge data when it exceeds 5 MB or each day, whichever limit is first attained.
If you do configure more than one day to retain local store files and the data size of the combined files 
reaches 95000Mb, a FATAL message is sent to the system diagnostic...

19-8
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 19      Understanding Logging
  About Logging
When you configure a critical log target, and a message is sent to that critical log target, the message is 
also sent to the configured noncritical log target on a best-effort basis.
When you configure a critical log target, and a message does not log to that critical log target, the 
message is also not sent to the configured noncritical log. 
When you do not configure a critical...

19-9
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 19      Understanding Logging
  About Logging
Table 19-3 Remote Syslog Message Header Format
Field Description
pri_numPriority value of the message; a combination of the facility value and the 
severity value of the message. Priority value = (facility value* 8) + severity 
value. The facility code valid options are:
LOCAL0 (Code = 16)
LOCAL1 (Code = 17)
LOCAL2 (Code = 18)
LOCAL3 (Code = 19)
LOCAL4 (Code = 20)
LOCAL5 (Code =...

19-10
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 19      Understanding Logging
  About Logging
The syslog message data or payload is the same as the Local Store Message Format, which is described 
in Table 19-2.
The remote syslog server targets are identified by the facility code names LOCAL0 to LOCAL7 (LOCAL6 
is the default logging location.) Log messages that you assign to the remote syslog server are sent to the 
default location for Linux syslog (/var/log/messages),...

19-11
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 19      Understanding Logging
  About Logging
The Monitoring & Report Viewer has two drawer options:
Monitoring and Reports—Use this drawer to view and configure alarms, view log reports, and 
perform troubleshooting tasks.
Monitoring Configuration—Use this drawer to view and configure logging operations and system 
settings.
In addition to the information that is captured in the log messages described in Logging Categories,...

19-12
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 19      Understanding Logging
  ACS 4.x Versus ACS 5.3 Logging
ACS 4.x Versus ACS 5.3 Logging
If you are familiar with the logging functionality in ACS 4.x, ensure that you familiarize yourself with 
the logging functionality of ACS 5.3, which is considerably different. Ta b l e 1 9 - 4 describes the 
differences between the logging functionality of ACS 4.x and ACS 5.3.
Table 19-4 ACS 4.x vs. ACS 5.3 Logging Functionality...

19-13
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 19      Understanding Logging
  ACS 4.x Versus ACS 5.3 Logging
Configuration Use the System Configuration > Logging 
page to define:
Loggers and individual logs
Critical loggers
Remote logging
CSV log file
Syslog log
ODBC logSee Configuring Logs, page 18-21 and the 
CLI Reference Guide for the Cisco Secure 
Access Control System 5.3.
Viewing and Downloading Log 
MessagesUse the Reports and Activity pages. See Viewing Log...

19-14
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 19      Understanding Logging
  ACS 4.x Versus ACS 5.3 Logging