What is the syslog record format for NSP application log forwarding?

Introduction

The NSP can be configured to forward NSP application-log entries for various functions, as well as NFM-P server log entries, to a remote syslog server, as described in the NSP Installation and Upgrade Guide. The following topics describe the syslog record formats of NSP application and NFM-P server log entries.

NSP application log entries

Different NSP functions log different types and amounts of information. Consequently, an NSP application log entry does not have a fixed length or number of fields, so the following topic describes only the syslog record format, and not each type of record entry.

NFM-P server log entries

When NFM-P server log forwarding is enabled, the standalone or primary NFM-P main server forwards each entry written to the local EmsServer.log file to the specified syslog server.

NSP application syslog record format

Each syslog record for an NSP functional area has the following fields:

• timestamp

• hostname of syslog message producer

• program name, which is appslogs

• log entry

Note: The log entries do not share a common format, as the number and type of fields in an entry is function-specific.

The following is a syslog record entry example:

Nov  9 11:10:28 nsp-1a3 appslogs: {app-specific_log_entry}

The fields in the example record have the following values:

• timestamp—Nov 9 11:10:28

• hostname of syslog entry producer—nsp-1a3

• program name—appslogs

• log entry—function-specific_log_entry, which is a comma-separated list of colon-separated attribute-value pairs that contain the log-entry message and other information, for example:

  "attribute1":"value","attribute2":"value","attribute3":"value"

NFM-P server syslog record format

Each NFM-P server log entry has the following fields:

• timestamp

• hostname of syslog message producer

• program name, which is nfmpserverlogs

• server log entry

The following is an example of a syslog record that contains an NFM-P server log entry:

Nov 7 05:40:15 nfmp-dc_1 nfmpserverlogs:{EMS_server_log_entry}

The fields in the example record have the following values:

• timestamp—Nov 7 05:40:15

• hostname of syslog entry producer—nfmp-dc_1

• program name—nfmpserverlogs

• server log entry—EMS_server_log_entry, which is a comma-separated list of colon-separated attribute-value pairs that contain the log-entry message and other information, for example:

  "attribute1":"value","attribute2":"value","attribute3":"value"