Syslog issue in LMS 4.2

Hi I am facing weired issue with devcies syslogs. I can see syslog from only few devices though we have 160 devices.
can any one help me to get it running.
Thanks

First thing to look at is if the devices are configured properly to send syslogs to ciscoworks.
If yes, check Syslog.log (win) or syslog_info (sol/lin) to see if the missing devices syslog appears in that file. If the syslog is present in file, check filters if the filters are configured properly to forward the syslog to syslog DB else they might be dropped.
Attached image explains the Ciscoworks Syslog Architechture properly.
-Thanks
Vinod

Similar Messages

  • LMS 4.2.4 intermittent Syslog issue

    Hi All,
    syslogs services on the LMS stops all of a sudden and doesn't reflect the current logs from the devices till we restart services.
    Performed below steps
    -> Found the device logs are making its way to syslog.log file(CSCOpx>logs)
    -> SyslogCollector and SyslogAnalyzer are in healthy state.
    -> Even the collector subscription status is fine.
    After the restart of the SyslogCollector and SyslogAnalyzer  the logs reflects back on lms. Issue is intermittent and reappeared couple of times. any suggestions to find root of the problem ??
    Regards,
    Channa

    Hi Channa,
    looks like , you are getting huge no. of syslogs from your devices..
    SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,389, Anonymous Dropping the syslog as queue is full 100000
    SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,390, Anonymous Dropping the syslog as queue is full 100000
    SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,390, Anonymous Dropping the syslog as queue is full 100000
    SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,391, Anonymous Dropping the syslog as queue is full 100000
    SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,392, Anonymous Dropping the syslog as queue is full 100000
    SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,393, Anonymous Dropping the syslog as queue is full 100000
    SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,393, Anonymous Dropping the syslog as queue is full 100000
    SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,394, Anonymous Dropping the syslog as queue is full 100000
    SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,394, Anonymous Dropping the syslog as queue is full 100000
    SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,395, Anonymous Dropping the syslog as queue is full 100000
    SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,396, Anonymous Dropping the syslog as queue is full 100000
    SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,396, Anonymous Dropping the syslog as queue is full 100000
    SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,397, Anonymous Dropping the syslog as queue is full 100000
    and which is why they are getting dropped.
    2 suggestions:
    check the filters > configure the filters for only those messages that you want
    second :
    plan to upgrade the LMS from 4.2.4 to 4.2.5 .  LMS 4.2.5 have a fix of  the syslogs issue . in 4.2.5 syslogs are well managed.
    BUG:CSCul38962 : Syslog dropping issue
    above BUG is fixed in 4.2.5
    Thanks-
    Afroz
    ***Ratings Encourages Contributors ****

  • SYSLOG Cisco Prime LMS

    Hi friends,
    I have a question about my syslog from Cisco Prime LMS 4.1, the hours from this syslog in the LMS is diferent from my switch log.  I dont kown why.. I verified the hours betewen switch y the Cisco Prime is the same(the LMS is over Windows Server 2008R2) . both are the same log but in diferent hours about 5 hours.
    maybe I have to configure the hours for Syslog in the Cisco Prime.
    Log from Switch
    Log from Cisco Prime LMS

    If you have LMS, i am not sure, but if you have PI 1.2. Take a look at my post.
    Basically, syslog feature doesn't work well. I could see couple of syslog through event / alarm, but syslog itself is not working properly.
    https://supportforums.cisco.com/message/3861981#3861981

  • Core switches experience High CPU while generating syslog report from LMS

    Hi Everyone,
    Are there anyone who experience that the CPU utilization of some devices went up while generating a report from RME. Basing from other monitoring tool SNMP is taking up a huge cpu process. Any idea why this happened considering that the report is generated daily but only on one instance it caused the core switches to be paralyze due to high cpu. Changing the SNMP community string is the immediate action that resolve the issue to disconnect it from LMS.
    BTW, this is LMS 2.6.
    Thank you.

    The problem did not reoccurred any more. When I checked on the Syslogcollector.log it appeared that it is unable to subscribe. I assumed that the reason why snmp packets were flooded during the time that it they experience high cpu is because the client is generating syslog report for all devices while the syslog collector is not subscribe. Is this possible?
    Thanks

  • Dynamic User update issue on LMS 3.2

    Win2008 VM:
    1. Campus Manager 5.2.1
    2. CiscoView 6.1.9
    3. CiscoWorks Assistant 1.2.0
    4. CiscoWorks Common Services 3.3.0
    5. Device Fault Manager 3.2.0
    6. Integration Utility 1.9.0
    7. LMS Portal 1.2.0
    8. Resource Manager Essentials 4.3.1
    hello
    Setup Dynamic Updates on LMS a few months back and tested ok with a WS-C2960-24PC-L running c2960-lanbasek9-mz.122-52.SE. Dynamic Updates has now stopped working! no changes on LMS or on switch. i've attached a trace debug for MAC UHIC - i can see the mac address (sent by the 2960) ok but the process ends with "macuhic INFO MacUhicDBTransaction: No data in the MAC notification entry.getMacEventSize() is 0". i've also attached the mac notification config on the 2960.
    previously i could configure the 2960 switch from LMS through the Device Trap Configuration page. now when i try this i get:
    There are no ports to configure for the selected device(s).
    Check whether you have selected any router(s).
    any ideas on where i go from here?
    thanks
    andy
    ps i've also rebooted server but issue persists

    hello
    thanks for the response. i had found the following in the MACUHIC log:
    2010/10/08 16:15:33 main macuhic INFO TrapListenerFilterImpl: FileNotFoundExcpetion was caught since NMSRoot\campus\etc\cwsi\portsData.xml and NMSRoot\campus\etc\cwsi\vlanData.xml file is not found
    2010/10/08 16:15:33 main macuhic INFO TrapListenerFilterImpl: FileNotFoundException occured since Campus Data Collection has not run even once
    2010/10/08 16:15:33 main macuhic INFO TrapListenerFilterImpl: NullPointerException occured since there are no XML files. XML file will be generated only at the completion of Data Collection
    i checked NMSRoot\campus\etc\cwsi and these files didn't exist.
    i reinitialized the ANI database and done a network discovery before running a full Data Collection. Data Collection finishes but the  vlanData.xml and portsData.xml still aren't created.
    when i now try and run a manual UT acquisition i get the error:
    Failed to start acquisition: Construction of XML data required for UT is in progress. Please try after some time.
    there are 2 autonomous AP managed by LMS but i excluded them from the Data Collection - does this sound like bug CSCtd49439?
    i've attached a pdshow output - the ani.log contains a lot of IP/naming which i'll have to edit
    cheers
    andy

  • Third Party Syslog on Windows LMS

    Fortunately,  I’ve previously been referred to the following whitepaper here with regards to installing a standalone syslog daemon on an LMS server.
    However, I’m wondering if anyone has successfully implemented the local mode solution on a Windows instance of LMS?
    If so, what edition of syslog-ng did you use?
    Or alternatively, has anyone successfully installed another syslog receiver on a Windows LMS server that was able to forward messages to both internally to LMS and additional NMS hosts whilst maintaining the original source host details?
    Thanks for any feedback.

    You added the tag, lms2.6.  In LMS 2.6, the only supported syslog server is the crmlog server which ships with LMS.  Not even syslog-ng was tested.  The syslog-ng support will require LMS 3.2.  As for setting this up, I have only done it on Solaris.
    It might be easiest to install Cygwin on your server, build syslog-ng under Cygwin (with spoofing enabled), then use the Cygwin syslog-ng binary.  Finding a Windows native binary, or trying to build it with Win32 (if even possible) would probably be too much of a hassle.
    Please support CSC Helps Haiti
    https://supportforums.cisco.com/docs/DOC-8895
    https://supportforums.cisco.com

  • Issue wrt LMS 4.0 on VMware ESX4.1

    Hi;
    I am facing issue during installation of Cisco Works LMS 4.0 on Windows 2008 Server R2 Enterprise 64 bit VMware ESX 4.1 instance. The installation is termicating and give me following error:
    "You cannot install CiscoWorks LAN Management Solution 4.0 on an unsupported operating system or when Terminal Services is running on the supported Windows 2003 Server Standard Edition, Windows 2003 Server Enterprise Edition, Windows 2003 R2 Server platforms, and Windows 2008 Server Enterprise Edition.
    The setup program will exit when you click OK
    You must either upgrade the operating system on the server to a supported version or install CiscoWorks LAN Management Solution 4.0 on another server that runs a supported operating system."
    As per Cisco document LMS 4.0 support VMware ESX 4.1, Windows 2008 Server R2 Enterprise 64 bit.
    Please help me in this regards; Also found the screen shot in attachment.
    Thanks
    Shoaib

    this is not quite correct, LMS 4.0 does not support Windows 2008 R2 per default:
    http://www.cisco.com/en/US/partner/prod/collateral/netmgtsw/ps6504/ps6528/ps11200/ps11202/data_sheet_c78-610760.html
    it is windows 2008 with service pack 1 and 2 which are supported - not R2
    But, nevertheless, it is supported with a patch available on CCO. See this doc:
    http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.0/install/guide/instl.html#wp1616783

  • EEM syslog issue

    I have an issue with the syslog output of my eem script. The syslog command below does work. It sends an individual syslog message to my mgmt station for EACH line of cli output. I confirmed this with wireshark. The "show log" output looks fine (see below). I would like to get all the cli output or at least most of it in ONE large syslog message Anyone know how to fix this?
    <script>
    event manager applet SH_IP_NAT_STATS
    event timer cron name nat_stats cron-entry "0-59/5 * * * *"
    action 1.1 cli command "sh ip nat statistics"
    action 1.2 syslog msg "cli: $_cli_result"
    Log Buffer (52000 bytes):
    000080: *Nov 15 04:30:00.052: %HA_EM-6-LOG: SH_IP_NAT_STATS: cli:
    Total active translations: 38 (1 static, 37 dynamic; 38 extended)
    Peak translations: 135, occurred 00:25:23 ago
    Outside interfaces:
      FastEthernet0/0, FastEthernet0/1
    Inside interfaces:
      Vlan10
    Hits: 6270  Misses: 0
    CEF Translated packets: 1078, CEF Punted packets: 5192
    Expired translations: 622
    Dynamic mappings:
    -- Inside Source
    [Id: 1] route-map nonat interface FastEthernet0/1 refcount 37
    Appl doors: 5
    Normal doors: 0
    Queued Packets: 0

    Ah, I misunderstood.  There are a number of ways you could do this.  One thing that might be easiest is to configure two applets:
    event manager applet MARVEL
    event syslog pattern "%MWR2900MRVL_FLTMG-5-EVENT_WARNING"
    action 1.0 cli command "enable"
    action 2.0 syslog msg "MWR2900MRVL: Marvell Chip Bug detected"
    action 3.0 cli command "clear mac-address-table secure"
    action 4.0 cli command "config t"
    action 5.0 cli command "event manager applet MARVEL"
    action 6.0 cli command "event none"
    action 7.0 cli command "exit"
    action 8.0 cli command "event manager applet MARVEL-countdown"
    action 9.0 cli command "event timer countdown time 3600"
    action 9.1 cli command "end"
    event manager applet MARVEL-countdown
    event none
    action 1.0 cli command "enable"
    action 2.0 cli command "config t"
    action 3.0 cli command "event manager applet MARVEL-countdown"
    action 4.0 cli command "event none"
    action 5.0 cli command "event manager applet MARVEL"
    action 6.0 cli command "event syslog pattern %MWR2900MRVL_FLTMG-5-EVENT_WARNING"
    action 7.0 cli command "end"

  • Captive issues with LMS

    I am having the following two issues:
    I have created a course that consists of six lessons. I have
    placed the course on our LMS. Whenever I leave the course before
    completing - and from wherever I leave it - when I return it takes
    me to Question 3 of the Lesson 1 assessment every time.
    Also, when I do finish the last assessment, the LMS is not
    getting the "Completion" status from the content. The LMS still
    shows me as "in-progress". And the LMS is only registering a total
    of 45 points even though I have answered every question correctly.
    I'm not sure why this is happening, because the total points in the
    course based on advanced interaction is 100 points. Please help!
    Out of ideas. Thanks!

    How did you 'create a course consisting of 6 lessons'?
    You can't merge multiple, separate CP projects into one SCO.
    If that's essentially what you've done, then tracking is
    likely getting
    all thrown-off because each SCO is attempting to track itself
    by its own
    ID, which the LMS is likely not expecting.
    (i.e. when one CP lesson sends back 'user left at p4', the
    LMS sends
    back 'p4' when the lesson is relaunched, but how does the
    lesson know
    which Captivate's p4 should be resumed?)
    So a bit more detail on how you structured this may help.
    Ideally, just
    create one SCO (content package, etc) per CP lesson and use
    the LMS menu
    to navigate between them.
    Helps?
    Erik
    mh6hst wrote:
    > I have created a course that consists of six lessons. I
    have placed the course
    > on our LMS. Whenever I leave the course before
    completing - and from wherever I
    > leave it - when I return it takes me to Question 3 of
    the Lesson 1 assessment
    > every time.
    Erik Lord
    http://www.capemedia.net
    Adobe Community Expert - eLearning
    http://www.adobe.com/communities/experts/
    http://www.awaretips.net -
    Authorware Tips!

  • Syslog issue

    I have syslog schedule job that runs every morning at 7am. every Monday
    it runs empty until I restart the daemon, it's been doing it for several week. Today I have't restarted the daemon and started poking around, I went in and ran  log roation since the syslog_info was large but that didn't help. Any other suggestion ?

    What version of LMS are you running? Go to Common Services ---> Software Center --> Software Update and post the screenshot of version.
    How large is the syslog.log file?
    Post the SyslogCollector.log and SyslogAnalyzerUI.log file.
    And if you don't care for the syslog.log file, you can stop the CiscoWorks Daemon and delete the syslog.log and restart the daemon manager so it can automatically create a new one.

  • Quiz issue on LMS

    Hi all.
    I really hope someone can help - I have been haunted by this
    problem for weeks now!
    I have created my first quiz on Captivate 3. When I launch it
    on LMS as soon as I click on the first question I get a pop up
    message saying: is this the end of your learning activity? Click
    yes to exit or cancel.
    I have reviewed my quiz property and set up hundreds of
    times! Is this and issue within Captivate 3?
    Thank you so much for a reply.
    Opunthia

    Not sure which version of SumTotal you are using, but this
    has worked well for me using SumTotal 7.2 and Captivate 3 (SCORM
    1.2).
    The SCORM.htm file is a template file that Captivate uses
    each time your project is published. If we make changes to this
    file, it will affect all future projects we publish. If you follow
    these steps correctly, we can replace the original SCORM.htm, with
    another one that will prevent the premature "end of activity"
    message, until the user clicks the exit button from within your
    captivate project.
    Step 1: Back up this file (just in case).
    C:\Program Files\Adobe\Adobe Captivate
    3\Templates\Publish\SCORM.htm
    Step 2: Edit the original SCORM.htm file.
    Right click on the SCORM.htm file. Choose 'Open With' and
    select "Notepad' (or your preferred HTML editor).
    Delete the existing code, and paste the new code into it.
    (See bottom of my post)
    Step 3: Save the file, and publish your project.
    And we are done! Save the SCORM.htm file and close it, launch
    Adobe Captivate 3 and publish your project!
    It is very important that the exit button from within Captivate
    is used. You must use a "skin" in Captivate 3, so that there is
    an exit button. Using the Close button from within Internet
    Explorer will cause your results to not be sent to the SumTotal
    LMS.
    As long as you make it very clear at the end of your project
    which exit button to use, it shouldn't be a problem.
    New HTML code:

  • Delete fault and event syslog report - Prime LMS 4.2

    Hi all
    I created a fault and event report on my syslog data.  I run this report weekly.  I now need to change setting in that report but I'm not able to see where to edit this report. I see my job scheduled in the list but not able to modify anything.  Can someone help me on this
    Thank you very much for your help.

    Hi ,
    Report must have a Job id for that Job , you can delete it  via CLI :
    1. Make note of the job ID's that you want to delete.
    2. Open a dos shell and go to NMSROOT\CSCOpx\bin
    3. Issue the command:
    cwjava -cw NMSROOT com.cisco.nm.cmf.jrm.jobcli
    3. It will take you to the Job CLI mode
    4. Issue the command:
    delete 1700  ( 1700 is the job ID , you wanted to delete)
    5. Close all CiscoWorks browsers and issue the commands:
    net stop crmdmgtd
    net start crmdmgtd
    6. Wait 15 minutes and log back in to CiscoWorks
    hope it will help
    Thanks-
    Afroz
    ***Ratings Encourages Contributors ***

  • Integrate Remote Syslog Collector with LMS 4.1

    We have LMS 4.1 in our network. We had recently installed Remote Syslog Collector on a new Server to collect logs from all the devices. How can we integrate the Remote Syslog Collector with the LMS Server?
    Thanks in Advance.

    You simply have to subscribe the IP address of the Remote Syslog Collector in Ciscowork LMS server under :
    Admin > Collection Settings > Syslog > Syslog Collector Status
    Once it is subscribed, it should start working, simialar to how it works when Syslog Collector is Local on LMS server.
    For more details see docuement :
    http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.1/install/guide/appendc.html#wp1049873
    -Thanks

  • Syslog Issue in RME

    Hi ,
    I am able to see sylog messeges if I  enable snmp syslog traps in my device. but not able to generate syslog messages report in RME , I have already enabled logging commands with LMS IP and default port 514 in my devices, all other syslog services are also running fine., I have also enabled syslog backup policy with default path.
    Pls find the attached logs and kindly check where may be the isuue.
    Rgds,
    Kamal Singh
    9910213708

    I do not see any Cisco syslog messages in this syslog.log file.  If you have logging enabled on the devices, make sure that udp/514 is open between the device and the LMS server.  To verify that the messages are making it to the server, start a sniffer trace on the LMS server filtering on udp/514 traffic.  Generate some messages from a test device, and confirm that you see those messages in the sniffer trace.  If not, check with your firewall or network administrators to make sure there are no filters or ACLs which could be blocking this traffic.

  • Syslog issue in ACE

    I worked the ace on last night
    I configured two context, 128 and 130
    There are no problem in load-balancing server farm
    but there are some issue in logging-server
    I configured the logging buffer 6 to send the system message to syslog server
    I didn't configured the resource-class related syslog buffer in admin context it's default unlimit
    In the this morning.
    I logged in the syslog server and saw the log to check syslog message from ace.
    but there are no syslog message in my syslog server. In my think, the ace doesn't send syslog to syslog server. so I cleared log message in system buffer, and I received the log message from ace.
    What happen in ACE? It it a possible bug? or Am I missed configured ?
    Anyone who tell me why this situation happen?
    Why I could receive the log after clear the log in ace?
    I have to clear the log buffer to receive the syslog from ace?
    the configuration like below
    logging enable
    logging standby
    logging console 3
    logging timestamp
    logging trap 6
    logging buffered 6
    logging host 192.168.100.1 udp/514
    the system image is "c6ace-t1k9-mz.3.0.0_A1_6_2a.bin"

    that's weird, but it might be because the syslog resource being all used already, it couldn't be allocated to your new context and the syslog process failed to start.
    Once you cleared the buffer in Admin, you freed the syslog resources and the context could activate the syslog process.
    We do recommend to set a max-limit to the syslog buffer to avoid consuming all the resources to allow creation of new contexts.
    Gilles.

Maybe you are looking for