Antivirus in Ciscoworks Server

Hi is there any dependacies of LMS 3.2 with Antivirus like Symantec end point protection? I want to to install Symantec end point protection in my LMS server. Will it impact on any of the feature of LMS?

Hi,
Generally, the advice concerning anti-virus software is:
1. Completely disable during LMS installation
2. Exclude everything under CSCOpx from real-time scans
It is possible that additional settings will impact LMS so I suggest a look and see approach. Try enabling the feature and watch the event logs for problems. If the software has a 'warn' only option enable that first. It should give you a good idea of what it is doing.
Thanks,
Nick

Similar Messages

CiscoWorks: Not receiving syslogs, since we change CiscoWorks server IP Address

Hi,
We are using CiscoWorks 3.2.1. We have changed CiscoWorks server IP Address, since then we are not receiving syslogs from Devices. Although devices configurations have also been changed so that they log to new IP Address e.g. logging new IP Address. But we are not getting syslogs now.
Rest all operations of CiscoWorks are working ok. E.g. We can access it from IE, inventory/config collection working, we can deploy configs etc. But we are not getting syslogs.
Also :
Test Collector Subscription Status
SSL certificate status SSL certificates are valid and properly imported
Collector status Collector Server_IP_Address is up and reachable.
but I am not seeing any new alerts receiving here.
When I do start the SyslogCollector.log/SyslogAnalyzer.log from server, I get below message;
E:\Ciscoworks\log>net start crmlog
The requested service has already been started.
More help is available by typing NET HELPMSG 2182.
E:\Ciscoworks\log>pdexec SyslogCollector.log
ERROR: cmd failed. Server reason: Application SyslogCollector.log is not registe
red. All requests to operate on this application will be ignored.
E:\Ciscoworks\log>pdexec SyslogAnalyzer.log
ERROR: cmd failed. Server reason: Application SyslogAnalyzer.log is not register
ed. All requests to operate on this application will be ignored.
E:\Ciscoworks\log>
Please advise what need to be changed on CiscoWorks in reference to new IP Address.Its required urgently.
Thanks

We have already remove the logging on old IP from devices, and now about 4000 devices are logging to new IP.
Above mentioned problem is on CiscoWorks only, as its not collecting the syslogs. Below error message might suggest some solution.
E:\Ciscoworks\log>net start crmlog
The requested service has already been started.
More help is available by typing NET HELPMSG 2182.
E:\Ciscoworks\log>pdexec SyslogCollector.log
ERROR: cmd failed. Server reason: Application SyslogCollector.log is not registered. All requests to operate on this application will be ignored.
E:\Ciscoworks\log>pdexec SyslogAnalyzer.log
ERROR: cmd failed. Server reason: Application SyslogAnalyzer.log is not registered. All requests to operate on this application will be ignored.
E:\Ciscoworks\log>

Ciscoworks Server Performance Issue

Hi ,
I have a CiscoWorks Server running LMS 2.6 version.I have seen the cpu utilization is spiking always between 85 - 95%.Also observed there are atleast 15-20 instances of cwjava.exe are running. The process dbsrv9.exe and sm_server.exe is taking memory around 1.1GB.
Please let me know is this the normal behavior in ciscoworks server.We are managing around 650 devices through ciscoworks server.
Please let me know your observation.
Thanks in advance.
Thanks & Regds,
Lalit

Hi Lalit,
     When you say " the cpu utilization is spiking always between 85 - 95%." , do you mean it is sitting there continuously, or is it running at a lower level of CPU and then regularly spiking to 85 - 95 %. Has your LMS server always run with this CPU utilization, or has it changed recently for no apparent reason ?
     What platform are you running LMS 2.6 on, in particlar the CPU power and the amount of physical memory and swap space (Page file in windows) that you have configured ?
     In terms of multiple cwjava.exe processes, that is normal. To relate these processes to specific LMS process names, execute the command pdshow from the server cli and then match the process id to the process id for specific cwjava.exe processes.
     The process dbsrv9.exe is the database server. There should be multiple of these processes running, 1 for each database. If you follow the process above you will be able to relate the one that is holding a lot of memory, to a specific LMS Database process. Which one is holding the memory ?
     The process sm_server.exe is one of the main processes for DFM. It is normal for this process to hold a lot of memory and consume a lot of CPU (DFM is very resource intensive). In particular, each time you re-start the LMS daemons, DFM re-discovers all of the network elements that it is managing, and this is resource intensive and depending on the number of devices can take some time to complete.
     I hope this helps.
Regards
Derek Clothier

License Issue on Back Up Ciscoworks Server

We are trying to setup a backup server for our primary Ciscoworks server to get redundancy . We setup the new server and restored the backup on the redundant server and is working fine. However when we click on any of the installed modules say RME , DFM etc we get a message that we have a trial license of 90 days and we should license the product . However when we go to the Licensing we see that all the Modules are Licensed and it shows status as Never Expired.
We are having Ciscoworks LMS 2.6 with CM, DFM, RME, IPM etc modules installed.
I would like to know for the backup server do we need to have a seperate license , or while restoring the database something has gone wrong.
Regards

In continuation to the post , I checked for the license file on my backup server and I could not find any license file , all were showing as the eval90 days
When we were installing the backup server it had prompted us for the license details and we put in the PAK and the PIN details which we had put in the original server.
I don't understand why the valid license file has not got created.
Regards

How to manage the Cisco ACS 3.3 from ciscoworks server ?

i have ACS 3.3 server appliance and want to manage it from the ciscoworks server .i wanted to see it in the campus manager and can i manage ite inventory ?
Cisco Secure Access Control Server Solution Engine.

Hai,
Yes absolutely right. ACS appliance cannot be managed since SNMP cannot be enabled in ACS.
I tried but after raising TAC case with Cisco they told it is not possible.
In campus manager u cannot view the cisco devices ACS,NIDS and PIX firewall
Hope this information is useful

CiscoWorks Server Syslog file is growing

Hi ,
I have a Ciscoworks server in which syslog.log file are continueously growing everyday in size.When i checked the syslog file i have observed that most of the logs related to DOT1X-5-SUCCESS or AUTHMGR.Because of this syslog file size is increasing like anything.Is there any way where i can filter this log file and drop in ciscoworks server itself. By achieving this i can reduce the size of the syslog file and also block non required logs.
If there is any way then please let me know how do i achieve.
Thanks in advance.
Thanks & Regds,
Lalit

The best way to control the syslog.log is to control the device sending syslog messages. If that is a specific one which is sending a lot of messages configure the device not to send any syslog to control the size.
For details on how LMS Syslog works, please check my document :
http://docwiki.cisco.com/wiki/Network_Management_Configuration_Example_for_Ciscoworks_LMS_Syslog_Configuration_via_GUI
If this is not viable, the best way to control the syslog.log or any log file is to configure Logrot Utility within Ciscoworks.
Log files rotation helps you manage the log files more efficiently. See Maintaining Log Files for an overview of maintaining the log files in CiscoWorks Server.
Logrot is a log rotation program that enables you to control the log files size growth. It helps you to:
            > Rotate log files while CiscoWorks is running.
            > Optionally archive and compress rotated logs.
            > Rotate log files only when they have reached a particular size.
Logrot helps you easily add new files. You can configure Logrot either from the UI or from the CLI.
For more details, please check :
Using Logrot
Managing Log Files
Logrot from GUI
-Thanks

AntiVirus on Oracle Server

Hi Friends,
You guys have the practice to install antiVirus on Oracle Servers Running Windows or even RedHat?
What do you guys think as a pros and cons?
Tks

KeenOnOracle wrote:
Billy Verreynne had these comments that do not add anything to anyone. Totally unnecessary.Comments were aimed at showing how totally unnecessary and ridiculous anti-virus files scanners are as defensive measure on a server.
Especially a database server - as data is "uploaded" into SQL tables and not into o/s files. So what exactly is an anti-virus scanner suppose to scan?
Database files? Bad idea. It can crash the database.
Server executables? Why? These come from trusted installation and patching media - and not some adhoc upload.
What is the major attack vector for a database server? SQL injection.
So just how and where does an anti-virus scanner fit into the database server picture?
Anti-virus scanners is a knee jerk re-action to one of the worse, security wise, operating systems, ever designed and written. Microsoft Windows. And in typical Microsoft fashion, security problems are attempted to be reactively dealt with (after compromisation and infection), and not proactively.
Not saying that reactive action is not needed - but it should and must play second fiddle to proactive action. I bet that many a Windows database server is managed by an 'admin' that has no idea what services are enabled and what services should not be enabled for a database platform.

CiscoWorks "Server Not Ready" Admin Web Page

When trying to login to Admin webpage we received a page stating "Server Not Ready"
Please wait..... System is still coming up. You will be redirected to login page soon
with an OK button. Clicking button reloads page and seems to have no effect.
Looking at Windows event viewer I see no errors/warnings.
Looking at log files contained within Ciscoworks folders I can see the syslog file growing and a JAVA error in the SMTP.log
and error in TomcatMonitor.log of TomcatMonitor: non-handled Msg from dmgtd:1111708500
I have download the CiscoWorks Troubleshooting PDF with no success or related steps to troubleshoot.
Any suggestions for troublshooting?

There is no file NameServiceMonitor.log that I can find?
There is an CampusOGSServer.log that is about 70 MB and has errors related to SQL queries.
attach are the other two stderr.logs.
Windows Services status
CW ANI db engine   started     manual
CW Daemon MGR   started     auto
CW RME NG DB     started     manual
CW Tomcat Servlet started     manual
CW Visibroker         started     manual
CW Web Server       started     manual
CWCS Cmf DB        started     manual
CWCS rsh/tcp serv NOT STARTED manual
I started this process myself and was able to launch the admin login page but was unable to login. Going to the server console I noticed about 30 cwjava.exe processes running and windows explorer would not come up. I restarted the server. I will updated as it restarts and I look around some more.
recent contents of EDS.log file
[Tue Feb 16 14:31:18 CST 2010] Manager initComplete
[Tue Feb 16 14:31:18 CST 2010] Logger initComplete
[Tue Feb 16 14:31:18 CST 2010] Compiler available
[Tue Feb 16 14:31:18 CST 2010] Loader initComplete
[Tue Feb 16 14:31:18 CST 2010] Atom initComplete
[Tue Feb 16 14:31:18 CST 2010] Factory initComplete
[Tue Feb 16 14:31:19 CST 2010] Filter Repository initComplete
[Tue Feb 16 14:31:19 CST 2010] Event Repository initComplete
[Tue Feb 16 19:12:33 CST 2010] Manager initComplete
[Tue Feb 16 19:12:33 CST 2010] Logger initComplete
[Tue Feb 16 19:12:33 CST 2010] Compiler available
[Tue Feb 16 19:12:33 CST 2010] Loader initComplete
[Tue Feb 16 19:12:33 CST 2010] Atom initComplete
[Tue Feb 16 19:12:34 CST 2010] Factory initComplete
[Tue Feb 16 19:12:34 CST 2010] Filter Repository initComplete
[Tue Feb 16 19:12:34 CST 2010] Event Repository initComplete
java.lang.OutOfMemoryError: unable to create new native thread
at java.lang.Thread.start(Native Method)
at com.inprise.vbroker.util.DaemonThread.start(DaemonThread.java:13)
at com.inprise.vbroker.orb.ThreadPool.doWork(ThreadPool.java:248)
at com.inprise.vbroker.orb.TPDispatcherImpl.dispatch(TPDispatcherImpl.java:51)
at com.inprise.vbroker.orb.SocketSCM.newConnection(SocketSCM.java:93)
at com.inprise.vbroker.orb.SocketSCM$ListenerThread.run(SocketSCM.java:36)
at java.lang.Thread.run(Thread.java:479)
[Fri Mar 05 08:59:04 CST 2010] Manager initComplete
[Fri Mar 05 08:59:04 CST 2010] Logger initComplete
[Fri Mar 05 08:59:04 CST 2010] Compiler available
[Fri Mar 05 08:59:04 CST 2010] Loader initComplete
[Fri Mar 05 08:59:05 CST 2010] Atom initComplete
[Fri Mar 05 08:59:05 CST 2010] Factory initComplete
[Fri Mar 05 08:59:05 CST 2010] Filter Repository initComplete
[Fri Mar 05 08:59:05 CST 2010] Event Repository initComplete
[Fri Mar 19 17:07:54 CDT 2010] Manager initComplete
[Fri Mar 19 17:07:54 CDT 2010] Logger initComplete
[Fri Mar 19 17:07:55 CDT 2010] Compiler available
[Fri Mar 19 17:07:55 CDT 2010] Loader initComplete
[Fri Mar 19 17:07:55 CDT 2010] Atom initComplete
[Fri Mar 19 17:07:55 CDT 2010] Factory initComplete
[Fri Mar 19 17:07:55 CDT 2010] Filter Repository initComplete
[Fri Mar 19 17:07:56 CDT 2010] Event Repository initComplete

Where is the tftp file archive path in ciscoworks server?

Dear all,
I want to use ciscoworks up/down load IOS.but do not know where is the IOS file path in ciscoworks
Would you please help tell me?
Thanks and best regards!

It depends on the platform. On Windows, it's NMSROOT\tftpboot. On Solaris, it's typically /tftpboot.

Antivirus for windows server (2012R2)

I have Symantec Endpoint Protection they have a server package and a client package it works very well for us here!

Howdy,
So, I am learning a little late that it is not a good thing to install an AV on a server that was designed for a workstation, as it deeply affects performance due to on-access scanning, and other things.
There are several solutions that boast about good server performance, blah blah blah, but I was wondering what you fine people have experienced in the real world.
I am looking for something I can fine-tune and change settings like only scan on write, etc. So far Kaspersky is looking nice, but again, I was wondering what you all are using and how you like it.
Thanks in advance!
This topic first appeared in the Spiceworks Community

Symantec antivirus Best practice for oracle database on windows server 2003

Hi all,
I have an oracle database server on windows server 2003 platform of version 10.2.0.4. what would be best practice of running symantec antivirus on that server as well as database file exclusions from scanning them.
My server had rebooted unexpectedly for many times. in event log i have id as 6008. what may be cause of it..?

Normally, you don't run a virus scanner on a database server because your database server isn't vulnerable to viruses. It's behind firewalls, people aren't reading mail on it, people aren't plugging thumb drives into it, etc. If you do decide that you need to run a virus scanner on a database server, at least exclude the Oracle data files from the scan. Oracle gets very unhappy if someone else tries to open its data files (or, worse, if someone opens a data file before it gets the chance to acquire exclusive access).
Justin

Ciscoworks License Server/Daemon Manager is down.

Hello,
It seems i have a major issue with my Ciscoworks server. Whenever i try to go to Netconfig, or inventory, or basically anything i get this error
"License Server/Daemon Manager is down. Please check license.log for more information."
The license.log file doesn't show much, here is the last few lines
"[ Tue Mar 01 12:01:03 EST 2011 ] [CS_License:LiceneServer-Thread-656] INFO com.cisco.nm.license.server.LicenseServer - Executing GetFeature
[ Tue Mar 01 12:01:03 EST 2011 ] [CS_License:LiceneServer-Thread-656] INFO com.cisco.nm.license.server.LicenseServer - Got VMS features
[ Tue Mar 01 12:01:03 EST 2011 ] [CS_License:LiceneServer-Thread-656] INFO com.cisco.nm.license.server.LicenseServer - Getting CMF features
[ Tue Mar 01 12:07:10 EST 2011 ] [CS_License:LiceneServer-Thread-657] INFO com.cisco.nm.license.server.LicenseServer - Executing GetFeature
[ Tue Mar 01 12:07:10 EST 2011 ] [CS_License:LiceneServer-Thread-657] INFO com.cisco.nm.license.server.LicenseServer - Got VMS features
[ Tue Mar 01 12:07:10 EST 2011 ] [CS_License:LiceneServer-Thread-657] INFO com.cisco.nm.license.server.LicenseServer - Getting CMF features
Can anyone assist with this please?

The service was already stopped. I did not stop it. When i tried to start it it stopped striaght away... see below
C:\>net stop crmdmgtd
The CiscoWorks Daemon Manager service is not started.
More help is available by typing NET HELPMSG 3521.
C:\>net start crmdmgtd
The CiscoWorks Daemon Manager service is starting.
The CiscoWorks Daemon Manager service could not be started.
The service did not report an error.

LMS 3.2 on Solaris 10 - Cannot tftp vlan.dat to server

Hi All,
I've read several posts and could not find one that would resolve my issue.
I get the partially successful on several switches. I understand that is because of LMS not being able to tftp vlan.dat back to server.
I tried it directly on a switch and the transfer only works if the filename is already created in the tftp directory. Is there a way to change that?
Thanks
Jose Ribeiro

Hi Joseph,
The ciscoworks server has full access to the switch as per below. Neither access nor credentials seem to be the issue here.
I've read a few posts where it was stated the need to create a 'dummy' vlan.dat file so that the device would not show as partially successful on the RME job. Is this the case here? If so this is a very strange solution.
Thanks,
Jose
-bash-3.00$ ssh [email protected]
[email protected]'s password:
CC
WARNING: This system is for authorized use only. Any or all access to or
uses of this system may be monitored and recorded and subject to audit.
Use of this system is expressed consent to such monitoring and recording.
Unauthorized or improper use of this system is prohibited and is subject
to criminal and civil penalties.
ctspotdcemsw302>ena
Password:
ctspotdcemsw302#
ctspotdcemsw302#sh ver
Cisco Internetwork Operating System Software
IOS (tm) s72033_rp Software (s72033_rp-ENTSERVICESK9_WAN-M), Version 12.2(18)SXF1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2005 by cisco Systems, Inc.
Compiled Tue 20-Dec-05 19:11 by kellmill
Image text-base: 0x40101040, data-base: 0x42D60000
ROM: System Bootstrap, Version 12.2(17r)S2, RELEASE SOFTWARE (fc1)
BOOTLDR: s72033_rp Software (s72033_rp-ENTSERVICESK9_WAN-M), Version 12.2(18)SXF1, RELEASE SOFTWARE (fc1)
ctspotdcemsw302 uptime is 3 years, 28 weeks, 3 hours, 16 minutes
Time since ctspotdcemsw302 switched to active is 3 years, 28 weeks, 3 hours, 35 minutes
System returned to ROM by power cycle at 17:32:48 UTC Wed Jan 11 2006 (SP by power on)
System restarted at 05:35:07 EST Sun Feb 25 2007
System image file is "disk0:/s72033-entservicesk9_wan-mz.122-18.SXF1.bin"
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
[email protected].
cisco WS-C6509-E (R7000) processor (revision 1.1) with 458720K/65536K bytes of memory.
Processor board ID SMG0832N2ZV
SR71000 CPU at 600Mhz, Implementation 0x504, Rev 1.2, 512KB L2 Cache
Last reset from power-on
SuperLAT software (copyright 1990 by Meridian Technology Corp).
X.25 software, Version 3.0.0.
Bridging software.
TN3270 Emulation software.
15 Virtual Ethernet/IEEE 802.3 interfaces
266 Gigabit Ethernet/IEEE 802.3 interfaces
1917K bytes of non-volatile configuration memory.
8192K bytes of packet buffer memory.
65536K bytes of Flash internal SIMM (Sector size 512K).
Configuration register is 0x2102
ctspotdcemsw302#exit
Connection to 10.86.109.3 closed by remote host.
Connection to 10.86.109.3 closed.
-bash-3.00$

DCR Server Error LMS 4.0

Hi,
Dear Expert.
first of all i apologies that my English is not good.
i am using Microsoft Windows Server 2003 Enterprise Edition SP1 and using CiscoWorks
LAN Management Solution
Version 4.0
when i click on discovery button in inventory menu. then i face this problem. kindly help me how can i discover my network devices.? i am using Routers, Switches, CMTS, Peplinks and Servers.
Error
Error in communicating with DCR Server. DCR Server may be down. Please start the DCR Server and then start discovery.

Can you try accessing the LMS application locally from the server using http://localhost:1741 and duplicate the problem? The error in the logs implies the server is attempting to use a different address that is out of scope from the original DCR setup.
com.cisco.nm.dcr.DCRException: CSTM Error Code [-3] CSTM Comm Type [0] - URN_OUT_OF_SCOPE : "LocalDCR"
Do the following steps:
1. Stop the CiscoWorks Daemon manager from the cli using "net stop crmdmgtd".
2. Add the the CiscoWorks server to the host file mapping it to the ip address of the interface. Using notepad, open C:\WINDOWS\SYSTEM32\DRIVERS\etc\hosts file. Add an entry "79.98.184.60 DELL6800" and save the file.
3. Goto CSCOpx/bin and run the "perl hostnamechange.pl" and reboot the server.
4. Start the services using "net start crmdmgtd" if it has not started on start up.
5. Access the LMS page from the server itself using "http://localhost:1741" and duplicate the problem with the "admin" user.
Let us know the results.

High memory utilization after few days - ciscoworks LMS 4.0.1

Hello,
I have the problem that our ciscoworks server gets out of memory after few days. The memory utilization is always getting higher an higher (above 95%). Sometimes it is only after 3 days and sometimes it is after 1 week. So it happens not regulary. Has anyone an idea what could be the problem? I have made an screenshot from the services which use a lot of memory. And at this time the memory utilization is getting higher and higher again....I think there is a problem with tomcat or dbsrv10.exe, there are also a lot of cwjava.exe running.
Kindly regards
David Mayer

Hello,
I have the same problem. First time I've tried to upgrade memory from 8gb to 16gb but I am still experiencing same issues (Memory is running on 98%). I'm not sure exactly what process it is causing this issue, because when I've checked all proccesses from all users running on this server and count them there is no 15 gb at all. My guess is the same for tomcat server which is responsible for RME collector, or correct me if I'm wrong.
Do you have any idea what can cause this problem.
I've tried to upgrade then to Cisco works Prime lan management 4.1, but server went with same issues.
Thanks a lot

Antivirus in Ciscoworks Server

Similar Messages

Maybe you are looking for