Security Compliance

Use the CMC checklogs command to display log files in SEM

The SEM CMC checklogs CLI command displays the contents of the syslog facilities (log files) containing raw logs via Syslogs or SNMP traps

First published date

11/29/2018 10:37 PM

Last published date

4/2/2025 10:27 PM

Overview

When setting up a new syslog device to send logs to SEM, it is often helpful to view the content of syslog facilities directly. This helps confirm if your are seeing the IP address of the source device you are expecting to be receiving logs from. And it also allow you to confirm what facility you want to set the connector to read from when setting up a connector. Add and modify connectors for agent and manager devices 

The checklogs command is used to view the exact text of the syslog facilities, which will be the raw syslog/SNMP Trap messages from source devices.

Product section

Security Event Manager

Resolution

  1. Access the CMC prompt via
    • Hyper-v / Vmware Virtual Console of SEM Guest VM: Arrow down to Advanced Configuration, and then press Enter.(Note: Starting with SEM 2020.4 you will have to enter the "cmc" user password to login. In previous versions there was no need.
    • SSH Client: Log in using your CMC credentials to Putty or other SSH Client application you use
  2. And follow the "Troubleshoot network device logging or syslog device logging in SEM" guide and then use below tips on how to navigate to checklogs log viewer.
    Note: You can press Enter to accept the default (End).
  3. Select the number of lines to return.  
    Note: You can press Enter to accept the default (500).
  4. Press Enter to load the file.
  5. Once you have loaded the file, you can use operators to search for strings.
    • Forward slash (/) to search down the log file.
    • Question mark (?) to search up the log file.
    • Shift + G to go to the bottom of the log file.
    • gg to go to the top of the log file.
    • h to see the help and other options that can be used.