90000+ syslog messages a day on each of our WiSMs

Getting the following:
Oct 8 11:00:38 wlc-wism1 wlc-wism1: *Oct 08 15:00:38.763: %APF-3-GET_TKN_BKT_FAILED: apf_policy.c:327 Could not get Token Bucket Entry. All token entries are already in use.
Oct 8 11:00:38 wlc-wism1 wlc-wism1: *Oct 08 15:00:38.764: %PEM-3-ADDSTA: pemrecv.c:637 00:22:41:8b:ed:8c 0.0.0.0 Cannot get token index
Oct 8 11:00:38 wlc-wism1 wlc-wism1: *Oct 08 15:00:38.765: %SYSTEM-3-SYSAPI_ERR: sysapi.c:161 System Error : Msg 'Rate Table Entry set' of Airespace Tables failed, Id = 0x000d3f3d error value = 0xfffffffb
Oct 8 11:00:38 wlc-wism1 wlc-wism1: *Oct 08 15:00:38.767: %SYSTEM-3-SYSAPI_ERR: sysapi.c:161 System Error : Msg 'Rate Table Entry set' of Airespace Tables failed, Id = 0x000c3f3d error value = 0xfffffffb
Oct 8 11:00:38 wlc-wism1 wlc-wism1: *Oct 08 15:00:38.772: %APF-3-GET_TKN_BKT_FAILED: apf_policy.c:327 Could not get Token Bucket Entry. All token entries are already in use.
Oct 8 11:00:38 wlc-wism1 wlc-wism1: *Oct 08 15:00:38.773: %PEM-3-ADDSTA: pemrecv.c:637 00:22:41:8b:ed:8c 192.168.2.7 Cannot get token index
Cisco's response is that this is an informational message only.
Anyone else experiencing this same issue?

Post a config of the WiSM's to see what logging options are enabled.

Similar Messages

CUCM Syslog Message ISSUE (kernel: Exceeded hashlimit)

Hello.
Our Customer using CUCM 9.0 (PUB :1 , Sub : 4) and 4 Voice Gateway Cisco 3945 (16 E1 PRI per each Gateway)
CUCMs have problem with syslog messages.
I saw these messages in rtmt syslog
- kernel: Exceeded hashlimit IN=bond0 OUT= MAC=34:40:b5:d5:63:e8:1c:e6:c7:52:44:40:08:00 SRC=130.1.254.27 DST=130.1.13.11 LEN=204 TOS=0x00 PREC=0x00 TTL=246 ID=19646 PROTO=UDP SPT=19200 DPT=30546 LEN=184
kernel: Exceeded hashlimit IN=bond0 OUT= MAC=6c:ae:8b:67:1a:28:bc:16:65:12:99:7f:08:00 SRC=130.1.254.27 DST=130.1.14.13 LEN=204 TOS=0x18 PREC=0xA0 TTL=253 ID=42621 PROTO=UDP SPT=26694 DPT=26842 LEN=184
What's the problem with these messages ?
And how can I solve this problem
Thanks.

I used to have the same problem, it was a sip trunk against to one CME, just reset the sip trunk in CUCM it fixed the error. it is because the end poing is sending a lot of requests to CUCM

Unterstanding syslog messages from our wlc

Hello,
we use two wlc 4402 (4.1.181.0) and several leightweight accesspoints (AIR-AP1010-E-K9 and AIR-AP1030-E-K9 ) connected to them.
On our syslog server we get a lot of messages from the two wlc, and there are 3 message types which I am a little bit afraid of.
1. ca. 10 times per hour we get the message
apf_80211.c:4792 APF-6-NO_CONFIG_CHANGES: Not saving 'apf.cfg' - no config changes."
Cisco system message guide:
Error Message %APF-6-NO_CONFIG_CHANGES: Not saving '[chars]' - no config changes.
Explanation Not saving - no config changes.
Recommended Action No action is required.
Does anybody know why we get this messages and if it's possibly to suppress them?
2. Intermittently (several times a day) we get the following message types:
a) [ERROR] spam_l2.c 723: Max retransmissions reached on AP 00:0B:85:56:63:40 (CONFIGURE_COMMAND^M , 2)"
b) [ERROR] spam_tmr.c 569: Did not receive hearbeat reply from AP 00:0b:85:56:ae:40"
The MAC address is not every time the same but one of our accesspoints.
On our network management system we get the following trap messages with nearly exactly the same timestamp:
14.01.2008 04:21:56 CET
AP ''00.0b.85.56.63.40'', interface ''0x1'' is down.
When Airespace AP's interface operation status goes down this trap will be sent.
bsnAPDot3MacAddress = 00.0b.85.56.63.40
bsnAPIfSlotId = 0x1
14.01.2008 04:21:56 CET
AP disassociated from Switch.
When an Airespace AP disassociates from a Airespace Switch, the AP disassociated notification will be sent with the dot3 MAC address of the Airespace AP. This will notify the management system to remove Airespace AP from this Airespace Switch.
bsnAPMacAddrTrapVariable =
14.01.2008 04:22:25 CET
AP associated with Switch.
When an Airespace AP Associates to a Airespace Switch, the AP associated notification will be sent with the dot3 MAC address of the Airespace AP. This will help the management system to discover the Airespace AP and add it to system.
bsnAPMacAddrTrapVariable =
bsnAPPortNumberTrapVariable = 1
Cisco system message guide:
a) Error Message %LWAPP-3-TX_ERR3: Max retransmissions for LWAPP control message reached on AP [hex]:[hex]:[hex]:[hex]:[hex]:[hex] for [chars] (number of pending messages is [dec])
Explanation Maximum number of times an LWAPP control packet is transmitted before declaring the AP dead has been reached for this AP. The AP may not be on the network, or might have rebooted.
Recommended Action Check if the AP has rebooted or if it has been removed from the network, or if there are connectivity issues between the AP and the controller.
b) Error Message %LWAPP-3-ECHO_ERR: Did not receive heartbeat reply; AP: [hex]:[hex]:[hex]:[hex]:[hex]:[hex]
Explanation Controller did not get a response for the AP heartbeat message. There may be connectivity issues between the AP and the controller.
Recommended Action Check if the AP has rebooted or if it has been removed from the network, or if there are connectivity issues between the AP and the controller.
Because we don't see any network problems I'm wondering why the connection is lost.
Does anybody have an idea, perhaps CSCsh13928 (http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsh13928, but we don't have much traffic on the wlans) ?
Is there any possibility to remotely check if the accesspoint rebooted?
If you need further information please give me a short feedback.
Many thanks in advance,
Thorsten Steffen

Thanks for the help.
I have set up to send email and syslog messages from the RME applications. LMS server immediately started to send messages to the email server but syslog messages are not forwarded to the syslog server. Everything was done according to your instructions except that the name of the first script (syslog_forward.pl) is made consistent with what the second script (.bat) refer to (forward1.pl). What's the problem? Do RME sends the standard syslog messages via UDP port 514?
Sincerely.

ACE : PROBE-FAILED and Syslog messages

Hi,
When a real server is in PROBE-FAILED status, I observe a syslog message at each trial of the proble. This fills our syslog server. Is there a mean to configure the ACE in such a way that a syslog message would be generated only when a transition occurs in the probe status ?
Thank you for any hints,
Yves

Hello,
You can utilize "logging trap " command and
"logging message level " command
in order to achive what you are seeking.
The "logging trap " command limits the logging messages sent to a syslog server based on severity.
If it is set to "5 - notification", all messages that have security level of 5 or lower number are sent to the syslog server.
You can disable the display of a specific syslog
message or change the severity level of a specific system log message using
"logging message level " command.
Not sure what kind of probe you are using but If it is ICMP probe and
the reason of probe failure is arp, it generates a message for every try
as below with severity level of 3, by default.
%ACE-3-251009: ICMP health probe failed for server 192.168.0.1, connectivity error: ARP not resolved for destination ip address
%ACE-3-251009: ICMP health probe failed for server 192.168.0.1, connectivity error: ARP not resolved for destination ip address
%ACE-3-251009: ICMP health probe failed for server 192.168.0.1, connectivity error: ARP not resolved for destination ip address
%ACE-3-251009: ICMP health probe failed for server 192.168.0.1, connectivity error: ARP not resolved for destination ip address
%ACE-3-251009: ICMP health probe failed for server 192.168.0.1, connectivity error: ARP not resolved for destination ip address
%ACE-5-441002: Serverfarm (SF) is now back in service in policy_map (fs) -->
class_map (#class_default_slb). Number of failovers = 0, number of times back in service = 0
%ACE-4-442007: VIP in class: 'VIP' changed state from OUTOFSERVICE to INSERVICE
%ACE-5-441002: Serverfarm (SF) is now back in service in policy_map (fs) -->
class_map (#class_default_slb). Number of failovers = 0, number of times back in service = 0
%ACE-4-442004: Health probe ICMP detected rserver r1 (interface vlan31) changed state to UP
%ACE-4-442001: Health probe ICMP detected r1 (interface vlan31) in serverfarm SF changed state to UP
If your "logging trap " is set to "5 - notification" and you do not want
the message "%ACE-3-251009:xxx" to be sent to syslog server,
you can change its security level like below.
switch/Admin(config)# logging message 251009 level 6
switch/Admin(config)# do show logging message 251009
Message logging:
message 251009: current-level 6 default-level 3 (enabled)
You can check the message id that is filling the syslog server
and change its security level to higher number than "logging trap ".
Regards,
Kimihito.

1000's of Returned Mail messages every day!

Hi All,
I am receiving thousands of Returned Mail and Undeliverable Mail messages every day in my Mail application.
Here is the problem description:
I used to have a MobileMe (.mac) account and a corresponding email address. I did not renew my MobileMe account this year. Now, whenever Mail receives any valid message to my existing RoadRunner email address, that same message is being automatically resent to the defunct .mac email address and since it is no longer a valid address, it is being returned to my inbox as Undeliverable or Returned. The same message is being resent apparently many many times for each valid message I receive in my inbox. The result is literally thousands of undeliverable email messages clogging my account. Each time it is resent, it copies all the headers and the original message so by the time the same message is received over and over again the message sizes are well over 2 MB in size! It is an endless repeating cycle.
What I have done so far:
Called RoadRunner - they said to delete and reinstall Mail
Deleted Mail and reinstalled
Deleted Mail preferences
Turned off all iSync functions
Searched for and deleted all references to the invalid .mac email address on my computer
Turned off all notifications from iCal
Upgraded OS from 10.5.x to 10.6.7
None of this has stopped the torrents of messages…PLEASE HELP.
Would not like to have to erase the hard drive and reinstall the OS from scratch if possible.
Here is what a typical returned message header looks like (Email address blocked out by me):
This message was created automatically by the mail system (ecelerity).
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
[email protected] (after RCPT TO): 550 5.1.1 unknown or illegal alias: [email protected]
Reporting-MTA: dns; hrndva-oedge04.mail.rr.com
Arrival-Date: Thu, 28 Apr 2011 13:25:39 +0000
Remote-MTA: dns; nk11b01-smtp-mx006.mac.com
Diagnostic-Code: smtp; 550 5.1.1 unknown or illegal alias: [email protected]
Last-Attempt-Date: Thu, 28 Apr 2011 13:25:39 +0000
Action: failed
Final-Recipient: rfc822; [email protected]
Status: 5.1.1
------ This is a copy of the original message, including all headers. ------
Return-Path: <[email protected]>
X-Authority-Analysis: v=1.1 cv=pN6kzQkhXdmdOr6Akjoh3kGBD/S3UyPMKQp53EJY+ro= c=1 sm=0 a=9Xqw66NJkoB9GertGQDpPQ==:17 a=n-kJSqksAAAA:8 a=nz4EaHi66Edgnas9-7sA:9 a=98jSFH7WqmUA:10 a=ayC55rCoAAAA:8 a=qyzg_sS0DHm6ZXvf9RAA:9 a=udDd3TAlAAAA:8 a=A-Ay9Xv3AAAA:8 a=13-m3CVyAAAA:8 a=Nq7WNfEEaPaVeQek9H8A:9 a=nCRpLGje-JdQZUhY4UwA:7 a=xKgkma0IJD8A:10 a=pdFTHh6Ffp0A:10 a=uqRLPZCTzCUA:10 a=60GRva4_FlB0_GV7:21 a=0a-loXuVl3_jPVwJ:21 a=9Xqw66NJkoB9GertGQDpPQ==:117
X-Cloudmark-Score: 0
X-Originating-IP: 50.90.215.242
From: <[email protected]>
Received: from [50.90.215.242] ([50.90.215.242:47870] helo=[10.0.1.4])
    by hrndva-oedge04.mail.rr.com (envelope-from <[email protected]>)
    (ecelerity 2.2.3.46 r()) with ESMTP
    id 73/88-28036-3CA69BD4; Thu, 28 Apr 2011 13:25:24 +0000
Content-Type: multipart/report; report-type=delivery-status; boundary="lvFcVbMq4Bmrb7Nos44Q+yDizFUn+uvxvchPCg=="
X-Mailer: Apple Mail (2.1084)
Date: Thu, 28 Apr 2011 13:24:24 +0000
Subject: Mail Delivery Failure
Resent-Date: Thu, 28 Apr 2011 09:25:23 -0400
Resent-From: Joe Blow <[email protected]>
To: [email protected]
Resent-To: [email protected]
Message-Id: <[email protected]>
--lvFcVbMq4Bmrb7Nos44Q+yDizFUn+uvxvchPCg==
Content-Type: text/plain
This message was created automatically by the mail system (ecelerity).
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
[email protected] (after RCPT TO): 550 5.1.1 unknown or illegal alias: [email protected]
THANK YOU FOR READING AND HELPING IF YOU CAN.
Bern

Are the returned messages showing all different recipients? If so, it's possible someone has hacked into your MobileMe account and is using it to send out spam.
A brute force spamming will result in thousands of failed return messages. That happens when a spammer sends out mail to a know mail server, such as Hot Mail. They'll send the same message to [email protected], [email protected], etc. Do this for thousands of addresses and many will be returned by the receiving server as undeliverable because there is no user on their system by [email protected], and any other address with no match.
Or, your address is simply being spoofed by a prolific spammer. They picked up your email address as a valid address and are spoofing it in the From field. Doesn't matter that the thousands of emails that went out from them with your name as the sender didn't come from you, the receiving server just assumes it did and you get the bounce messages.
For the first, go in and change your password and see if that stops the flow. For the latter, there's really nothing you can do. Spammers will only use someone's address for a short while. Otherwise, the "from" address gets blacklisted automatically by mail servers, which would cut off the spammer's ability to send out more crap in your name. Then it's someone else who has to put up with it for a few days.

Syslog Message

Hi all,
In my firewall ASA 5540,Every day I am getting the syslog message.
4
Jul 07 2014
08:57:39
[ Scanning] drop rate-2 exceeded. Current burst rate is 0 per second, max configured rate is 8; Current average rate is 7 per second, max configured rate is 4; Cumulative total count is 28683
Please explain about above mentioned syslog.

Hi Kabeer,
That is because of the threat detection value set on your ASA. This might be an attack.
Because of the scanning rate configured and the
threat-detection rate scanning-rate 3600
average-rate 15
command:
%ASA-4-733100: [144.60.88.2] drop rate-2 exceeded. Current burst rate is 0 per
second, max configured rate is 8; Current average rate is 5 per second, max
configured rate is 4; Cumulative total count is 38086
Recommended Action
Perform the following steps
according to the specified
object type that appears
in the message:
1.
If the object in the message is one of the following:
Firewall
Bad pkts
Rate limit
DoS attck
ACL drop
Conn limit
ICMP attck
Scanning
SYN attck
Inspect
Interface
Check whether the drop rate is ac
ceptable for the running environment.
2.
Adjust the threshold rate of the particular drop to an appropriate value by using the
threat-detection rate
xxx command, where
xxx
is one of the following:
acl-drop
bad-packet-drop
conn-limit-drop
dos-drop
fw-drop
icmp-drop
inspect-drop
interface-drop
scanning-threat
syn-attack
3.
If the object in the message is a TCP or UDP port
, an IP address, or a
host drop, check whether
or not the drop rate is accepta
ble for the running environment.
4.
Adjust the threshold rate of the particular drop to an appropriate value by using the
threat-detection rate bad-packet-drop
command.
Note
If you do not want the drop rate exceed warning to appear, you can disable it by using
the
no threat-detection basic-threat command.
You can refer the below mentioned cisco document for more information.
http://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs.pdf
Regards
Karthik

Can't get syslog messages from Remote SA520 over VPN

I'm trying to set up a central logging server on a debian system running rsyslog.
The syslog server is local & I have a branch office connected via a VPN. Both buildings have SA520 routers.
I have set up both firewalls to allow ANY from each network 192.168.150.X & 19.168.160.X
(also tried to add a rule for UDP514 but that didn't help)
The debian system is new & has no iptables set up
I've entered the syslog server IP in remote logging.
I've set up facilities in Send to syslog for both routers.
I am logging messages from the local router but don't see anything from the remote.
I've checked with wireshark & see no syslog packages from the remote (I do see SSL negotiation & others when using the web admin and of course the functioning vpn)
I rebooted the router to see if that mae a difference but no luck.
Any ideas why I can't get the syslog traffic across the VPN?

I do have the correct IP address of the syslog server set up. I do not want email logs so have not enabled that.
My setup is
remote lan > SA520-remote (192.168.160.1) > [ site to site IPSec VPN over WAN ] > SA520-local (192.168.150.1) > syslog server (192.168.150.25) & local lan
Firewall is set up to allow ANY IN & OUT to local lan on both routers.
I have also set up specific rules for UDP 514 Syslog traffic (no difference, currently disabled)
syslog server has -no- firewall at the moment.
Syslog server is receiving messages from the local router with no issues.
Log Severity is set to Information & Log Facility is set up to send to Syslog.
I have also setup a SNMP trap on the syslog server & pointed the remote router to it in hopes of diagnosing the issue.
Both routers have the latest firmware applied.
Using wireshark on the syslog server I see no traffic on UDP 514 (syslog) or UDP 162 (snmp)
I can use the WUI for the remote & ping the 160.1 with no problem. Both ping & TLS/TCP traffic show up in wireshark on the syslog server when I do so.
It looks to me like there is a problem routing the syslog messages out of the router & then back through the VPN.
Worst case I'll set up another syslog server on an old machine at the remote location & then cron the logs to the central syslog server but it really seems I shouldn't have to.

How can I set an event to repeat on a week day rather than a numerical day of each month?

How can I set an event to repeat on a week day rather than a numerical day of each month? I see an option at the bottom of the repeat window .... but I cannot use it. Actually, when I try it freezes up my Calendar.
Lorrene Baum Davis

These scrrenshots are from Snow Leopard - I would think that Lion wouldn't be too much different.

How can I DISABLE the pop up 'Would you like to copy it to Library', preventing this message from bothering for each and every book, again and again, time after time? (Windows 7 64bit US).

How can I DISABLE the pop up 'Would you like to copy it to Library', preventing this message from bothering for each and every book, again and again , time after time? (Windows 7 64bit US).
I guess this may be a feature request. Adobe may think this is a good message for every new eBook.
I sure would like to decide about that myself.
Thanks in advance if this will be changed.

singmk wrote:
Decided to setup the mail for exchange on my N8 so I could see my work emails. Worked like a charm but after a couple of hours decided I didn't like being that contactable so deleted the mailbox.
Now to the problem, during setup I was forced to enable the phone lock and had to pick a 7 digit alphanumeric code. Fair enough I thought and went ahead. When I removed the mailbox however the lock remained in place with the default auto time of 30 minutes. When I checked in Phone management there is no option to disable this lock so I thought I could at least change the default time to something bigger but when you try, it remains at 30 mins. You also can't disable the auto time as it pops up an error message saying can't unlock phone.
Does anyone know if I'm missing something obvious here or is this something which can't be disabled once it's switched on? I've done a soft reset back to factory settings with no luck and the only other thing I can think of is re installing the firmware which seems a bit extreme.
Would like to hope there is some way to have control over this. Can someone help?
Which firmware your N8 having now? You can check firmware by choosing Call, then type *#0000#.
My N8 works fine on security setting and able to define Phone auto lock period, by choosing Menu>Settings>Phone>Phone management>Security settings>Phone and SIM card>Phone auto lock period>User defined>Lock after(minutes)
You will prompt to enter Lock code each time u define auto lock priod or enable/disable auto lock.
Hope this can help you.
If you find this post helpful, please show your appreciation by clicking the Kudos star at the left. If it provides you the solution, please click on the GREEN Accept as Solution button at below

How to setup First day of each Fiscal Quater

I need to setup a time window for the first Work day in each Quater of any year.
I used the System_FiscalPeriods set to 544 week and selected Jan,Apr,Jul and Oct month as each element.
the issue is on oct 2013 the day falls on sept 30.
How can I setup such calendar perpetually or am I supposed to check these days manually every year and keep
tweaking as per my finace dept inputs reg the days.

Gerben,
This works fine if the work days falls on the 4 month you listed but for oct 2013 the day falls on sept 30
how to accomodate for that ?
thanks
Babu

Define event to repeat on the last day of each month?

(I've searched the forum and can't find this question addressed)
I want to create a repeating event for the last day of each month. Is this possible?

Unfortunately Apple does not have an option available that allows you to add an event repeating on the last day of the month. An "OK" way around this would be to repeat on the 1st of every month and send a reminder a day earlier. I know this is less then perfect but the only option currently available. If you happen to find a 3rd party program that allows such integration please don't hesitate to mention it here as I have been looking for this sort of option for quite some time now!

ACS appliance1120 ACS 4.2.1.15 syslog message to syslog server

Hi All ,
I am using ACS 1120 appliance running ACS version 4.2.1.15 , I am pointing out all syslog message to my external syslog server (passed authentication , failed authentication , database replication , administration aduit ,tacacs accounting ) , but i could recieve only passed authentication log message to my external log server , no other log message except passed authentication is pushed to my external log server , But i could see failed attempts , database replication,administrtation audit log message locally on my acs appliance as CSV file ,
Syslog server configuration is configured under all logging (passed , failed , administration , tacacs accounting ) , but i am surprise to see only passed authentication logg is sent out from acs appliance , Is there any patch to be installed for logg message scripting ?? , please advise ..

Refer the link : https://supportforums.cisco.com/discussion/11513026/migrating-acs-420-421
you can directly upgrade from 4.2.0.124 to 5.6 : http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-6/user/guide/acsuserguide/migrate.html#98379

HOW TO STOP THE PROMPTING MESSAGE OF MASTER PASSWORD EACH TIME I OPEN MOZILLA FIREFOX?

HOW TO STOP THE PROMPTING MESSAGE OF MASTER PASSWORD EACH TIME I OPEN MOZILLA FIREFOX?

Firefox will ask for the Master Password on startup if it is needed on a page.<br />
This can be Sync or a web page that is (re)opened automatically and you have saved a name & password for this website.
You didn't confirm whether you are using Sync or not, so I don't know which of the two would apply.

Messages per day in XI

HI,
Is there any transaction code where I can get the Statistics of Messages exchanged in XI on daily basis, for a month or more.
We have more than 50,000 messages being exchanged daily. Its hard to find the statistics in SXMB_MONI...So looking for a transaction...
Regards,
Vasu

Hi,
of course you can do it:
open runtime workbench and go to
<b>performance monitor</b>
from there you can see everything:
messages per day, week etc
one interface per day, week etc
aggegated messages etc
Regards,
michal

Creating new report 1st day of each month

Hello, all!
I have a vi that I run to record pressure on test units. I want to create a new excel report on the 1st day of each month. If it is not the 1st day of the month I want to just add the data for each test unit as a new worksheet. I have looked around and can't find a post for what I need to do exactly. If anyone can help, greatly appreciate.

Hey END82,
I agree with RTSLVU's suggestion of using the Seconds to Date/Time vi. From there you can wire the day of the month into a case structure, and have the case for day number 1 to be where you create a new excel report and have the other default case add the data to the report.
I attached a VI Snippet which you can drag onto a block diagram to look at.
Hope this helps!
Joe S
Applications Engineer
National Instruments
Attachments:
date.png ‏13 KB

90000+ syslog messages a day on each of our WiSMs

Similar Messages

Maybe you are looking for