Specifications

3-395
Cisco Wide Area Application Services Command Reference
OL-11817-01
Chapter 3 CLI Commands
(config) transaction-logs
syslog server. You can limit the rate at which the transaction logging module is allowed to send messages
to the remote syslog server. The format of the syslog message is in standard syslog message format with
the transaction log message as the payload of the syslog message.
Real-time transaction logging to a remote syslog server uses the standard syslog message format with
the message payload as the transaction log entry. A new syslog error identifier is defined for this type of
real-time transaction log message. You can configure a WAE to send transaction log messages in
real-time to one remote syslog host. The message format of the transaction log entry to the remote syslog
host is the same as in the transaction log file and prepended with Cisco’s standard syslog header
information.
The following is an example of the format of the real-time syslog message sent from the transaction
logging module (WAE) to the remote syslog host:
fac-pri Apr 22 20:10:46 ce-host cache: %CE-TRNSLG-6-460012: translog formatted msg
The fields in the message are described as follows:
• fac-pri denotes the facility parameter and priority for transaction log messages encoded (as in
standard syslog format) as a 32-bit decimal value between 0 and 1023 (0x0000 and 0x03FF). The
least significant 3 bits denote priority (0-7) and the next least significant 7 bits denote facility
(0-127).
The facility parameter used by the transaction logging module when a real-time transaction log
message is logged to the remote syslog host is user. The same facility is sent to the remote syslog
host unless you configure a different facility parameter for transaction logging. The priority field is
always set to LOG_INFO for real-time transaction log messages.
In the above example, the default value of fac-pri is 14 (0x000E) where facility = user (LOG_USER
(1)) and priority = LOG_INFO (6).
• The next field in the message is the date, which follows the format as shown in the above example.
• ce-host is the hostname or IP of the WAE that is sending the message.
• cache is the name of the process on the WAE that is sending the message.
• %CE-TRNSLG-6-460012 is the Cisco standard formatted syslog header on the WAE for a real-time
transaction log message. This identifier indicates a priority level of 6, which denotes informational
messages.
Note The WAAS system syslog messages report communication errors with the remote syslog
host that is configured for transaction logging. These syslog messages are in the error
message range: %CE-TRNSLG-6-460013 to %CE-TRNSLG-3-460016. The last error
message (%CE-TRNSLG-3-460016), shows level “3” (for error-level messages) instead of
“6” (for information-level messages). Information-level messages are reported when
messages are dropped due to rate limiting and the number of dropped messages are reported.
For more information about these syslog messages, see the Cisco WAAS System Messages
Reference.
• translog formatted msg is the transaction log message as it appears in the transaction log file.
Note The total length of the real-time syslog message is 1024 characters. If the actual transaction
log entry exceeds this limit, it is truncated.
When the remote syslog server logs this message to a file, the format appears as follows:
Apr 22 20:10:46 ce-host cache: %CE-TRNSLG-6-460012: translog formatted msg