Viewing and Managing System Logs

Feature History

Feature Name Release Information Description

Dedicated Application Debug Logs

Cisco Operations Hub 22.3

You can view application-specific debug logs using the Debug Dashboard.

Operations Hub provides a tool for log aggregation and management, leveraging the power of ElasticSearch-Logstash-Fluentd-Kibana (ELK) stack. The Operations Hub GUI uses Elasticsearch as the data store for logs, and Kibana provides meaningful visualization of the raw log data. You can create both macro and micro views using various visualization techniques.

Enabling Log Management using ELK stack

During deployment, the Operations Hub is configured to forward logs from all the components to ElasticSearch for aggregation and indexing, providing some default visualizations and also available for creating custom visualization, search, and analysis.

Viewing Audit Logs

This procedure enables you to view the audit logs.

Procedure

Step 1

At the main menu, select Systems > Logs.

The Audit Dashboard page appears.

Step 2

You can view the preconfigured information of audit logs in the following representations:

  • Histogram—A view that displays a count of audit logs against time.

  • Audit Log Table—A table that displays the audit logs generated based on user-initiated events from UI or using API interface.

    You can view the following information in the audit log table:

    Table 1. Audit Log
    Field Description

    Time

    The time when the event is logged.

    User

    The user who initiated the event.

    API

    The API that is called.

    Status

    The HTTP response status code that is returned on invoking the API.

    Response Time

    The time taken by the API to execute.

    Method

    The HTTP method the API used.

    Service Host

    The application that served the request.

  1. You can also search the logs based on following options:

    • Kibana Query Language (KQL) query or fields as specified in the logs, and save the search using Save Current Query.

    • Time duration as absolute time period, relative time, and now.

    • Using filter options based on fields and operator enables you to narrow down the search. You can also edit the filter as query DSL and create custom label to the search.

  2. Click Update to update the query.

  3. Click Refresh to refresh and add a new search query.

Viewing Debug Logs

This procedure enables you to view the audit logs.

Procedure

Step 1

At the main menu, select Systems > Logs.

The Debug Dashboard page appears.

Step 2

You can view the preconfigured information of audit logs in the following representations:

  • Histogram—A view that displays a count of audit logs against time.

  • Debug Log Table—A table that displays the audit logs generated based on user-initiated events from UI or using the API interface.

    You can view the following information in the debug log table:

    Table 2. Debug Log
    Field Description
    Time The time when the event is logged.
    User The user who initiated the event.
    API The API that is called.
    Status The HTTP response status code that is returned on invoking the API.
    Response Time The time taken by the API to execute.
    Method The HTTP method the API used.
    Service Host The application that served the request.

Viewing Logs Using Advanced Option

Advanced options enable you to create and customize the dashboards and visualizations as required.

Procedure

Step 1

At the main menu, select Systems > Logs.

The Debug Dashboard page displays.

Step 2

At the left-side menu, click Advanced. You can view the following submenus:

  • Dashboards—The Dashboard page allows you to view available dashboards or create a new dashboard view using the Create Dashboard. To create the new dashboard, add panels from saved 'Search' or 'Visualization', or you can create a new Visualization using available visualization types. Once you save the dashboard, click the Dashboard in the left side menu, and you can view the new dashboard.

  • Discover—The Discover page allows you to find logs based on custom search definitions. You can save the search and later access, and use the saved search in the Dashboard. You can perform basic text search and advanced search using the KQL or Lucene Search.

  • Visualize—The Visualize page enables you to view available library of logs or create a new Visualization. To create a new Visualization, click Create Visualizations, and select one of the available visualization types such as Lens, Maps, TSVB, Custom Visualization, and Aggregation based in the New Visualization page. Enter required search information. Once the visualization is created, you can save and use to create panels in the Dashboard.

Dedicated Application Debug Logs

If you have installed applications such as Smart PHY on Operations Hub, you can view the application-specific debug logs.

Procedure

Step 1

At the main menu, select Systems > Logs.

Step 2

At the left-side menu, click Debug Dashboard option under the application header to view application-specific debug logs.

Refreshing the Dashboard

You can set the refresh time for each dashboard, choose the time from the drop-down list on the top-right corner of the dashboard. You can select any time from 5 sec to 1 day. If you decide to avoid page refresh, selecting "off" from drop-down menu does not refresh the page.

If data is retrieved, you can choose a time range. It can be absolute time range where you can provide a time interval or you can select the range from a predefined drop down menu.

TAC Debug Package

Feature History

Feature Name Release Information Description

TAC Debug Package

Cisco Operations Hub 22.2

You can create TAC debug package for a cluster. The collected information helps the TAC team to debug and troubleshoot the issue at the earliest.

TAC Debug Package Enhancements

Cisco Operations Hub 22.3

You can create TAC debug package for a cluster using Operations Hub GUI. You can select start and end dates, and start and end times, while creating TAC Debug Packages. You can download TAC Debug Packages locally and delete TAC Debug Packages, if necessary.

The TAC Debug feature in Operations Hub enables you to create and collect the debug package for a specified time duration. You can download the debug package and attach it to a TAC case.

Once you trigger the create operation on the Operations Hub cluster, you can monitor the status of operation as ongoing or completed. Once the operation is complete, the TAC debug package is available for download.


Note

You can perform the TAC debug operations only using API and this feature is not supported in the Operations Hub GUI yet. For more information, see the Cisco Operations Hub and Smart PHY REST API Guide.

Creating and Downloading TAC Debug Package

To create a TAC Debug package:

  1. At the main menu, select System > System TAC Debug Packages.

  2. Enter the start and end dates, and start and end times, which are required for the data collection.

  3. Click Create. The TAC Debug package is created.

The latest package is displayed on top. Once a package is created:

  • You can download a package locally by clicking the package name.

  • You can delete a package by clicking the Delete icon.