Syslog issue in LMS 4.2
Hi I am facing weired issue with devcies syslogs. I can see syslog from only few devices though we have 160 devices.
can any one help me to get it running.
Thanks
First thing to look at is if the devices are configured properly to send syslogs to ciscoworks.
If yes, check Syslog.log (win) or syslog_info (sol/lin) to see if the missing devices syslog appears in that file. If the syslog is present in file, check filters if the filters are configured properly to forward the syslog to syslog DB else they might be dropped.
Attached image explains the Ciscoworks Syslog Architechture properly.
-Thanks
Vinod
Similar Messages
-
LMS 4.2.4 intermittent Syslog issue
Hi All,
syslogs services on the LMS stops all of a sudden and doesn't reflect the current logs from the devices till we restart services.
Performed below steps
-> Found the device logs are making its way to syslog.log file(CSCOpx>logs)
-> SyslogCollector and SyslogAnalyzer are in healthy state.
-> Even the collector subscription status is fine.
After the restart of the SyslogCollector and SyslogAnalyzer the logs reflects back on lms. Issue is intermittent and reappeared couple of times. any suggestions to find root of the problem ??
Regards,
ChannaHi Channa,
looks like , you are getting huge no. of syslogs from your devices..
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,389, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,390, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,390, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,391, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,392, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,393, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,393, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,394, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,394, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,395, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,396, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,396, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,397, Anonymous Dropping the syslog as queue is full 100000
and which is why they are getting dropped.
2 suggestions:
check the filters > configure the filters for only those messages that you want
second :
plan to upgrade the LMS from 4.2.4 to 4.2.5 . LMS 4.2.5 have a fix of the syslogs issue . in 4.2.5 syslogs are well managed.
BUG:CSCul38962 : Syslog dropping issue
above BUG is fixed in 4.2.5
Thanks-
Afroz
***Ratings Encourages Contributors **** -
Hi friends,
I have a question about my syslog from Cisco Prime LMS 4.1, the hours from this syslog in the LMS is diferent from my switch log. I dont kown why.. I verified the hours betewen switch y the Cisco Prime is the same(the LMS is over Windows Server 2008R2) . both are the same log but in diferent hours about 5 hours.
maybe I have to configure the hours for Syslog in the Cisco Prime.
Log from Switch
Log from Cisco Prime LMSIf you have LMS, i am not sure, but if you have PI 1.2. Take a look at my post.
Basically, syslog feature doesn't work well. I could see couple of syslog through event / alarm, but syslog itself is not working properly.
https://supportforums.cisco.com/message/3861981#3861981 -
Core switches experience High CPU while generating syslog report from LMS
Hi Everyone,
Are there anyone who experience that the CPU utilization of some devices went up while generating a report from RME. Basing from other monitoring tool SNMP is taking up a huge cpu process. Any idea why this happened considering that the report is generated daily but only on one instance it caused the core switches to be paralyze due to high cpu. Changing the SNMP community string is the immediate action that resolve the issue to disconnect it from LMS.
BTW, this is LMS 2.6.
Thank you.The problem did not reoccurred any more. When I checked on the Syslogcollector.log it appeared that it is unable to subscribe. I assumed that the reason why snmp packets were flooded during the time that it they experience high cpu is because the client is generating syslog report for all devices while the syslog collector is not subscribe. Is this possible?
Thanks -
Dynamic User update issue on LMS 3.2
Win2008 VM:
1. Campus Manager 5.2.1
2. CiscoView 6.1.9
3. CiscoWorks Assistant 1.2.0
4. CiscoWorks Common Services 3.3.0
5. Device Fault Manager 3.2.0
6. Integration Utility 1.9.0
7. LMS Portal 1.2.0
8. Resource Manager Essentials 4.3.1
hello
Setup Dynamic Updates on LMS a few months back and tested ok with a WS-C2960-24PC-L running c2960-lanbasek9-mz.122-52.SE. Dynamic Updates has now stopped working! no changes on LMS or on switch. i've attached a trace debug for MAC UHIC - i can see the mac address (sent by the 2960) ok but the process ends with "macuhic INFO MacUhicDBTransaction: No data in the MAC notification entry.getMacEventSize() is 0". i've also attached the mac notification config on the 2960.
previously i could configure the 2960 switch from LMS through the Device Trap Configuration page. now when i try this i get:
There are no ports to configure for the selected device(s).
Check whether you have selected any router(s).
any ideas on where i go from here?
thanks
andy
ps i've also rebooted server but issue persistshello
thanks for the response. i had found the following in the MACUHIC log:
2010/10/08 16:15:33 main macuhic INFO TrapListenerFilterImpl: FileNotFoundExcpetion was caught since NMSRoot\campus\etc\cwsi\portsData.xml and NMSRoot\campus\etc\cwsi\vlanData.xml file is not found
2010/10/08 16:15:33 main macuhic INFO TrapListenerFilterImpl: FileNotFoundException occured since Campus Data Collection has not run even once
2010/10/08 16:15:33 main macuhic INFO TrapListenerFilterImpl: NullPointerException occured since there are no XML files. XML file will be generated only at the completion of Data Collection
i checked NMSRoot\campus\etc\cwsi and these files didn't exist.
i reinitialized the ANI database and done a network discovery before running a full Data Collection. Data Collection finishes but the vlanData.xml and portsData.xml still aren't created.
when i now try and run a manual UT acquisition i get the error:
Failed to start acquisition: Construction of XML data required for UT is in progress. Please try after some time.
there are 2 autonomous AP managed by LMS but i excluded them from the Data Collection - does this sound like bug CSCtd49439?
i've attached a pdshow output - the ani.log contains a lot of IP/naming which i'll have to edit
cheers
andy -
Third Party Syslog on Windows LMS
Fortunately, I’ve previously been referred to the following whitepaper here with regards to installing a standalone syslog daemon on an LMS server.
However, I’m wondering if anyone has successfully implemented the local mode solution on a Windows instance of LMS?
If so, what edition of syslog-ng did you use?
Or alternatively, has anyone successfully installed another syslog receiver on a Windows LMS server that was able to forward messages to both internally to LMS and additional NMS hosts whilst maintaining the original source host details?
Thanks for any feedback.You added the tag, lms2.6. In LMS 2.6, the only supported syslog server is the crmlog server which ships with LMS. Not even syslog-ng was tested. The syslog-ng support will require LMS 3.2. As for setting this up, I have only done it on Solaris.
It might be easiest to install Cygwin on your server, build syslog-ng under Cygwin (with spoofing enabled), then use the Cygwin syslog-ng binary. Finding a Windows native binary, or trying to build it with Win32 (if even possible) would probably be too much of a hassle.
Please support CSC Helps Haiti
https://supportforums.cisco.com/docs/DOC-8895
https://supportforums.cisco.com -
Issue wrt LMS 4.0 on VMware ESX4.1
Hi;
I am facing issue during installation of Cisco Works LMS 4.0 on Windows 2008 Server R2 Enterprise 64 bit VMware ESX 4.1 instance. The installation is termicating and give me following error:
"You cannot install CiscoWorks LAN Management Solution 4.0 on an unsupported operating system or when Terminal Services is running on the supported Windows 2003 Server Standard Edition, Windows 2003 Server Enterprise Edition, Windows 2003 R2 Server platforms, and Windows 2008 Server Enterprise Edition.
The setup program will exit when you click OK
You must either upgrade the operating system on the server to a supported version or install CiscoWorks LAN Management Solution 4.0 on another server that runs a supported operating system."
As per Cisco document LMS 4.0 support VMware ESX 4.1, Windows 2008 Server R2 Enterprise 64 bit.
Please help me in this regards; Also found the screen shot in attachment.
Thanks
Shoaibthis is not quite correct, LMS 4.0 does not support Windows 2008 R2 per default:
http://www.cisco.com/en/US/partner/prod/collateral/netmgtsw/ps6504/ps6528/ps11200/ps11202/data_sheet_c78-610760.html
it is windows 2008 with service pack 1 and 2 which are supported - not R2
But, nevertheless, it is supported with a patch available on CCO. See this doc:
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.0/install/guide/instl.html#wp1616783 -
I have an issue with the syslog output of my eem script. The syslog command below does work. It sends an individual syslog message to my mgmt station for EACH line of cli output. I confirmed this with wireshark. The "show log" output looks fine (see below). I would like to get all the cli output or at least most of it in ONE large syslog message Anyone know how to fix this?
<script>
event manager applet SH_IP_NAT_STATS
event timer cron name nat_stats cron-entry "0-59/5 * * * *"
action 1.1 cli command "sh ip nat statistics"
action 1.2 syslog msg "cli: $_cli_result"
Log Buffer (52000 bytes):
000080: *Nov 15 04:30:00.052: %HA_EM-6-LOG: SH_IP_NAT_STATS: cli:
Total active translations: 38 (1 static, 37 dynamic; 38 extended)
Peak translations: 135, occurred 00:25:23 ago
Outside interfaces:
FastEthernet0/0, FastEthernet0/1
Inside interfaces:
Vlan10
Hits: 6270 Misses: 0
CEF Translated packets: 1078, CEF Punted packets: 5192
Expired translations: 622
Dynamic mappings:
-- Inside Source
[Id: 1] route-map nonat interface FastEthernet0/1 refcount 37
Appl doors: 5
Normal doors: 0
Queued Packets: 0Ah, I misunderstood. There are a number of ways you could do this. One thing that might be easiest is to configure two applets:
event manager applet MARVEL
event syslog pattern "%MWR2900MRVL_FLTMG-5-EVENT_WARNING"
action 1.0 cli command "enable"
action 2.0 syslog msg "MWR2900MRVL: Marvell Chip Bug detected"
action 3.0 cli command "clear mac-address-table secure"
action 4.0 cli command "config t"
action 5.0 cli command "event manager applet MARVEL"
action 6.0 cli command "event none"
action 7.0 cli command "exit"
action 8.0 cli command "event manager applet MARVEL-countdown"
action 9.0 cli command "event timer countdown time 3600"
action 9.1 cli command "end"
event manager applet MARVEL-countdown
event none
action 1.0 cli command "enable"
action 2.0 cli command "config t"
action 3.0 cli command "event manager applet MARVEL-countdown"
action 4.0 cli command "event none"
action 5.0 cli command "event manager applet MARVEL"
action 6.0 cli command "event syslog pattern %MWR2900MRVL_FLTMG-5-EVENT_WARNING"
action 7.0 cli command "end" -
I am having the following two issues:
I have created a course that consists of six lessons. I have
placed the course on our LMS. Whenever I leave the course before
completing - and from wherever I leave it - when I return it takes
me to Question 3 of the Lesson 1 assessment every time.
Also, when I do finish the last assessment, the LMS is not
getting the "Completion" status from the content. The LMS still
shows me as "in-progress". And the LMS is only registering a total
of 45 points even though I have answered every question correctly.
I'm not sure why this is happening, because the total points in the
course based on advanced interaction is 100 points. Please help!
Out of ideas. Thanks!How did you 'create a course consisting of 6 lessons'?
You can't merge multiple, separate CP projects into one SCO.
If that's essentially what you've done, then tracking is
likely getting
all thrown-off because each SCO is attempting to track itself
by its own
ID, which the LMS is likely not expecting.
(i.e. when one CP lesson sends back 'user left at p4', the
LMS sends
back 'p4' when the lesson is relaunched, but how does the
lesson know
which Captivate's p4 should be resumed?)
So a bit more detail on how you structured this may help.
Ideally, just
create one SCO (content package, etc) per CP lesson and use
the LMS menu
to navigate between them.
Helps?
Erik
mh6hst wrote:
> I have created a course that consists of six lessons. I
have placed the course
> on our LMS. Whenever I leave the course before
completing - and from wherever I
> leave it - when I return it takes me to Question 3 of
the Lesson 1 assessment
> every time.
Erik Lord
http://www.capemedia.net
Adobe Community Expert - eLearning
http://www.adobe.com/communities/experts/
http://www.awaretips.net -
Authorware Tips! -
I have syslog schedule job that runs every morning at 7am. every Monday
it runs empty until I restart the daemon, it's been doing it for several week. Today I have't restarted the daemon and started poking around, I went in and ran log roation since the syslog_info was large but that didn't help. Any other suggestion ?What version of LMS are you running? Go to Common Services ---> Software Center --> Software Update and post the screenshot of version.
How large is the syslog.log file?
Post the SyslogCollector.log and SyslogAnalyzerUI.log file.
And if you don't care for the syslog.log file, you can stop the CiscoWorks Daemon and delete the syslog.log and restart the daemon manager so it can automatically create a new one. -
Hi all.
I really hope someone can help - I have been haunted by this
problem for weeks now!
I have created my first quiz on Captivate 3. When I launch it
on LMS as soon as I click on the first question I get a pop up
message saying: is this the end of your learning activity? Click
yes to exit or cancel.
I have reviewed my quiz property and set up hundreds of
times! Is this and issue within Captivate 3?
Thank you so much for a reply.
OpunthiaNot sure which version of SumTotal you are using, but this
has worked well for me using SumTotal 7.2 and Captivate 3 (SCORM
1.2).
The SCORM.htm file is a template file that Captivate uses
each time your project is published. If we make changes to this
file, it will affect all future projects we publish. If you follow
these steps correctly, we can replace the original SCORM.htm, with
another one that will prevent the premature "end of activity"
message, until the user clicks the exit button from within your
captivate project.
Step 1: Back up this file (just in case).
C:\Program Files\Adobe\Adobe Captivate
3\Templates\Publish\SCORM.htm
Step 2: Edit the original SCORM.htm file.
Right click on the SCORM.htm file. Choose 'Open With' and
select "Notepad' (or your preferred HTML editor).
Delete the existing code, and paste the new code into it.
(See bottom of my post)
Step 3: Save the file, and publish your project.
And we are done! Save the SCORM.htm file and close it, launch
Adobe Captivate 3 and publish your project!
It is very important that the exit button from within Captivate
is used. You must use a "skin" in Captivate 3, so that there is
an exit button. Using the Close button from within Internet
Explorer will cause your results to not be sent to the SumTotal
LMS.
As long as you make it very clear at the end of your project
which exit button to use, it shouldn't be a problem.
New HTML code: -
Delete fault and event syslog report - Prime LMS 4.2
Hi all
I created a fault and event report on my syslog data. I run this report weekly. I now need to change setting in that report but I'm not able to see where to edit this report. I see my job scheduled in the list but not able to modify anything. Can someone help me on this
Thank you very much for your help.Hi ,
Report must have a Job id for that Job , you can delete it via CLI :
1. Make note of the job ID's that you want to delete.
2. Open a dos shell and go to NMSROOT\CSCOpx\bin
3. Issue the command:
cwjava -cw NMSROOT com.cisco.nm.cmf.jrm.jobcli
3. It will take you to the Job CLI mode
4. Issue the command:
delete 1700 ( 1700 is the job ID , you wanted to delete)
5. Close all CiscoWorks browsers and issue the commands:
net stop crmdmgtd
net start crmdmgtd
6. Wait 15 minutes and log back in to CiscoWorks
hope it will help
Thanks-
Afroz
***Ratings Encourages Contributors *** -
Integrate Remote Syslog Collector with LMS 4.1
We have LMS 4.1 in our network. We had recently installed Remote Syslog Collector on a new Server to collect logs from all the devices. How can we integrate the Remote Syslog Collector with the LMS Server?
Thanks in Advance.You simply have to subscribe the IP address of the Remote Syslog Collector in Ciscowork LMS server under :
Admin > Collection Settings > Syslog > Syslog Collector Status
Once it is subscribed, it should start working, simialar to how it works when Syslog Collector is Local on LMS server.
For more details see docuement :
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.1/install/guide/appendc.html#wp1049873
-Thanks -
Hi ,
I am able to see sylog messeges if I enable snmp syslog traps in my device. but not able to generate syslog messages report in RME , I have already enabled logging commands with LMS IP and default port 514 in my devices, all other syslog services are also running fine., I have also enabled syslog backup policy with default path.
Pls find the attached logs and kindly check where may be the isuue.
Rgds,
Kamal Singh
9910213708I do not see any Cisco syslog messages in this syslog.log file. If you have logging enabled on the devices, make sure that udp/514 is open between the device and the LMS server. To verify that the messages are making it to the server, start a sniffer trace on the LMS server filtering on udp/514 traffic. Generate some messages from a test device, and confirm that you see those messages in the sniffer trace. If not, check with your firewall or network administrators to make sure there are no filters or ACLs which could be blocking this traffic.
-
I worked the ace on last night
I configured two context, 128 and 130
There are no problem in load-balancing server farm
but there are some issue in logging-server
I configured the logging buffer 6 to send the system message to syslog server
I didn't configured the resource-class related syslog buffer in admin context it's default unlimit
In the this morning.
I logged in the syslog server and saw the log to check syslog message from ace.
but there are no syslog message in my syslog server. In my think, the ace doesn't send syslog to syslog server. so I cleared log message in system buffer, and I received the log message from ace.
What happen in ACE? It it a possible bug? or Am I missed configured ?
Anyone who tell me why this situation happen?
Why I could receive the log after clear the log in ace?
I have to clear the log buffer to receive the syslog from ace?
the configuration like below
logging enable
logging standby
logging console 3
logging timestamp
logging trap 6
logging buffered 6
logging host 192.168.100.1 udp/514
the system image is "c6ace-t1k9-mz.3.0.0_A1_6_2a.bin"that's weird, but it might be because the syslog resource being all used already, it couldn't be allocated to your new context and the syslog process failed to start.
Once you cleared the buffer in Admin, you freed the syslog resources and the context could activate the syslog process.
We do recommend to set a max-limit to the syslog buffer to avoid consuming all the resources to allow creation of new contexts.
Gilles.
Maybe you are looking for
-
How to transfer photos from an android phone
I do not know how to transfer photos from my Samsung Galaxy 3 cell phone to my ipad 2, (or to mypc for that matter). Technologically dumb as a rock! Thanks.
-
Hi...I have a laptop and I have had problems with skype home in the past, but not it will not work at all. It keep spinning. I am using windows 7 professional. Last nite I used piriform defraggler instead of the one built into my computer and now sk
-
hi, Im using macbook pro mid 2012 i got notification for upgrading to mac os x mavericks and its free of cos, but i dont have proper network connection now ,i will buy a broadband connection at dec 5 .. and willl it be free of cost till dec 5 ..
-
Following error is coming Alert Log my database: Errors in file c:\oracle\product\10.1.0\admin\bizwiz\bdump\bizwiz_dw01_4028.trc: ORA-00600: internal error code, arguments: [729], [220848], [space leak], [], [], [], [], [] Any Idea? Regards, Raj
-
TS3274 How can I type special characters like I can on my computer keyboard?
How can I type in special characters that I do not see on my iPad keyboard?