Central Syslog on Linux

- starting the collector without the option -v2
then when a instance start, the syslog shows Error 000104 : Connection reset by peer in Module rslgsend(027)
- starting the collector with -v2 all works well
i down loaded the latest rslgsend and rslgcol
has anyone the same problems ??l

John,
We use free port numbers (65501 => 65508)
I think the problem is the program rslgcoll. When we start the system with a trace option on for rslgcoll, it works good,
but when we start rslgcoll without the trace option, it gives the error message
Ben

Similar Messages

Installing Central Instance on Linux

Hello
Does anyone have manuals or any material that guides and show how to install a SAP Central Instance on LINUX?
The version of SAP is 4.7.
Regards

Hi,
Difference between a version and version SR1 is that - with SR1 DVDs you will get the system patched upto a respective Support Package right after installation. In essence, the SP is a part of the installation. So always better to go for a SR1 installation.
Difference between Extension Sets 1.1 and 2.0 is - additional functionality is delivered with the extension set 2.0. For eg. support yard management, cross-docking, VAS etc. So if you do not have a hard constraint from a functionality perspective, it would be best to go with Extension Set 2.0. However I believe you should discuss this with your functional team as they would give a better analysis.
Regards,
Srikishan

Forwarding Events to a central syslog server.

I need to find an easier way to forward all IDS events to a central Syslog server. I am doing it a cheesy way now by running a macro against the IEV database and extracting the results from the exported file. I used to be able to do this with the Unix Director. Is there an easy way to do this? Is there a raw event file that I could directly transfer from the IDS Sensor?

The following document should give you a better idea,
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/idmiev/swchap4.htm#wp860304

The central syslog is not showing the correct date

Time     SAP instance    Type Nr Clt User         TCode           Priority Grp N Text
95:52:83 ceas4359_DBP_04 BTC 011 500 SYS_LOGISKIS                          F7 7 Spool: Invalid Output Device
95:52:83 ceas4359_DBP_04 BTC 011 500 SYS_LOGISKIS                          F7 7 Spool: Invalid Output Device
95:52:93 ceas4359_DBP_04 BTC 007 500 SYS_LOGISKIS                          F7 7 Spool: Invalid Output Device
95:52:93 ceas4359_DBP_04 BTC 007 500 SYS_LOGISKIS                          F7 7 Spool: Invalid Output Device
95:54:57 ceas4359_DBP_04 BTC 011 500 SYS_LOGISKIS                          F7 7 Spool: Invalid Output Device
95:54:59 ceas4359_DBP_04 BTC 011 500 SYS_LOGISKIS                          F7 7 Spool: Invalid Output Device
95:54:59 ceas4359_DBP_04 BTC 011 500 SYS_LOGISKIS                          F7 7 Spool: Invalid Output Device
95:54:60 ceas4359_DBP_04 BTC 011 500 SYS_LOGISKIS                          F7 7 Spool: Invalid Output Device
95:54:71 ceas4359_DBP_04 BTC 011 500 SYS_LOGISKIS                          F7 7 Spool: Invalid Output Device
95:54:71 ceas4359_DBP_04 BTC 011 500 SYS_LOGISKIS                          F7 7 Spool: Invalid Output Device
95:54:79 ceas4359_DBP_04 BTC 011 500 SYS_LOGISKIS                          F7 7 Spool: Invalid Output Device
95:54:86 ceas4359_DBP_04 BTC 011 500 SYS_LOGISKIS                          F7 7 Spool: Invalid Output Device
95:54:86 ceas4359_DBP_04 BTC 011 500 SYS_LOGISKIS                          F7 7 Spool: Invalid Output Device
Please suggest , the needful !
Database system - oracle
Release - 10.2.0.2.0
Component version - SAP ECC 6.0

Only creative cloud subscribers get the new features. If you were a Cloud subscriber your version would be 16.4.0 not 16.0.4.

SCOM 2012 collect Windows Audit logs and forward them to a Linux Syslog server

Hello:
1. We have a SCOM 2012 server.
2. We have SNARE agents for PCI systems, but now we want to save money by gathering all events for all Windows servers using its native features.
3. We also have a centralized Linux server running SYSLOG which aggregates the logs to our Dell LogVault retention appliance (for PCI purposes)
Thus, my question:
In effort to remove the SNARE agents from the windows servers, can we implement Audit Collections Services (ACS) in the windows environment so that they collect/forward audit/event logs to the SCOM 2012 server and then SCOM forwards the events to the centralized
syslog Linux server? In which case they are aggregated to the Dell appliance.
We prefer to use the Linux syslog as the centralized log server but would like to know how to go about implementing the solution above.
Many thanks,
Robert Perez-Corona

Hi,
Here is a thread about how to make SCOM 2012 work as a syslog server, hope this can be helpful for you:
https://social.technet.microsoft.com/Forums/en-US/524ea527-c069-40f9-96ef-026a4aa06fe9/make-scom-2012-a-syslog-server?forum=operationsmanagergeneral
Regards,
Yan Li
Regards, Yan Li

Firewall notifications and alarms based on syslog keywords

HI, I have an ASA and we now have a requirement that we need to be notified in case of a security concern. I have the firewall sending syslog messages to a central syslog server but I would like to know based on what syslog keywords should I be sending out email notifications. For ex : if I get a syslog with a keyword "SYN ATTACK" (if there is such a syslog message) I will be sending out an alarm to the security team.
Is there another way of doing this? Another ex is if we have too many dropped packets or something of this type, then I need to be notified? Does the asdm have such a feature?
any recommendations?

Hello Ronni,
The Security Appliance will send email notifications due to any events you have configured based on a logging level or a logging list you have configured.
Here is one document I used before to know a little bit more about the email notifications feature.
http://community.spiceworks.com/how_to/show/388
Other way you can send the logging messages is using a logging class.
For example lets say you just want to send events related to failover and webvpn.
logging class ha mail 7
logging class webvpn mail 7
Hope this helps, any other question let me know.
Do please rate helpful posts.
Julio

Standard and sys audit to syslog

Hello,
I have question about enabling auditing to syslog.
Is it possible to configure standard and sys auditing to local syslog in linux environment?
I have read that from version 10.2 it is possible to add AUDIT_SYSLOG_LEVEL parameter to init.ora to send audit trail to syslog. But I need to have both auditings: standard auditing and sys operations auditing on a remote host using syslog.
Regards
Dominik

Hi,
I hope that the following document helps: http://www.springerlink.com/index/ut68j3652k06747j.pdf
Regards,
Naveed.

Syslog output to multiple destinations

Hi,
I have a central syslog server set up. I am only able to either send all syslog messages (from my Solaris 9 client) to the central systog server or store them locally. I want to do both ie., send the messages to the syslog server as well as store them locally. Does anyone know how to do this?
Regards

I tried it and it didnt work. Then I found out that there should be tab instead of white space b/w debug and @foo in the example below:
*.debug @foo
My config is:
*.err;kern.debug;daemon.notice;mail.crit /var/adm/messages
*.err;kern.debug;daemon.notice;mail.crit @foo

Can't get syslog messages from Remote SA520 over VPN

I'm trying to set up a central logging server on a debian system running rsyslog.
The syslog server is local & I have a branch office connected via a VPN. Both buildings have SA520 routers.
I have set up both firewalls to allow ANY from each network 192.168.150.X & 19.168.160.X
(also tried to add a rule for UDP514 but that didn't help)
The debian system is new & has no iptables set up
I've entered the syslog server IP in remote logging.
I've set up facilities in Send to syslog for both routers.
I am logging messages from the local router but don't see anything from the remote.
I've checked with wireshark & see no syslog packages from the remote (I do see SSL negotiation & others when using the web admin and of course the functioning vpn)
I rebooted the router to see if that mae a difference but no luck.
Any ideas why I can't get the syslog traffic across the VPN?

I do have the correct IP address of the syslog server set up. I do not want email logs so have not enabled that.
My setup is
remote lan > SA520-remote (192.168.160.1) > [ site to site IPSec VPN over WAN ] > SA520-local (192.168.150.1) > syslog server (192.168.150.25) & local lan
Firewall is set up to allow ANY IN & OUT to local lan on both routers.
I have also set up specific rules for UDP 514 Syslog traffic (no difference, currently disabled)
syslog server has -no- firewall at the moment.
Syslog server is receiving messages from the local router with no issues.
Log Severity is set to Information & Log Facility is set up to send to Syslog.
I have also setup a SNMP trap on the syslog server & pointed the remote router to it in hopes of diagnosing the issue.
Both routers have the latest firmware applied.
Using wireshark on the syslog server I see no traffic on UDP 514 (syslog) or UDP 162 (snmp)
I can use the WUI for the remote & ping the 160.1 with no problem. Both ping & TLS/TCP traffic show up in wireshark on the syslog server when I do so.
It looks to me like there is a problem routing the syslog messages out of the router & then back through the VPN.
Worst case I'll set up another syslog server on an old machine at the remote location & then cron the logs to the central syslog server but it really seems I shouldn't have to.

Running syslog without name lookup - what property?

All
I'm trying to run the syslog daemon (system-log in SMF) and prevent name lookups. We are logging many network devices to a central syslog server, and many of the switches don't have defined names in DNS. I want syslog to record the IP of the incoming packet, and not attempt a name lookup of the incoming IP. What SMF property in system-log controls this? Not having any luck finding information on this.
thanks

As far as i can determine from the OpenSolaris source, the hostname lookup feature is enabled automatically when the syslogd process is configured to handle remote log messages, and it seems there is no way of disabling it.
An alternative solution in this case is to switch to the syslog-ng (syslog Next Generation) open source syslog-daemon. Syslog-ng is quite more advanced and has a lot of nice features which aids the maintaining of larger environments.
With syslog-ng you disable hostname lookups by using the attribute 'use_dns'.
.7/M.

Mixed sap environment linux and windows

Hello,
I have a question regarding a mixed SAP environment. At the moment we are running win 2003 and sql server 2000. 1 central instance and two dialog. Now somebody suggested to migrate the central instance to linux and maxdb and keep the windows dialog instances! I've never heard about an os mixed sap environment!
Is this common or do you know such environments? Please send your feedback and pro and cons to this suggestion!
Thank you in advance!
Does anyone knows how much the SAP migration service is?
Best regards,
Frank

Why migrate off of Windows O/S? I serve 1500 concurrent users along with 90,000 users on web services on commodity hardware ($20,000 per server), all running on Windows 2003 SP2 x64 with uptime of 99.9% per month.
Just wondering.
edit: To answer your question, SAP is an application level program which deals with different O/S via different kernels. However, from an SAP app to SAP app level, everything is done via TCP/IP pipes. Doesn't matter if that pipe is provided by Linux, Unix, or Windows.
Edited by: Kevin Lin on Jul 10, 2008 8:44 PM

J2EE Status info unavailable after upgrade in NW2004s

Hi
I was upgrading the BI server. (AS ABAP, AS JAVA, BI-JAVA and EP)
of NW2004s from SP06 - SP09
The uprade went on well but anow after rebooting the server I dont see any J2EE processes running. In SAP MMC, next to the process disp+work.EXE the status is Running, Message Server connection ok, dialog queue time 0.0 sec, J2EE Status info unavailable
The Dev trace file is as follows
trc file: "G:\usr\sap\SID\DVEBMGS01\work\dev_jcontrol", trc level: 1, release: "700"
node name   : jcontrol
pid         : 7084
system name : SID
system nr. : 01
started at : Tue Jan 09 16:43:35 2007
arguments       :
       arg[00] : G:\usr\sap\SID\DVEBMGS01\exe\jcontrol.EXE
       arg[01] : pf=G:\usr\sap\SID\SYS\profile\SID_DVEBMGS01_hostname
       arg[02] : -DSAPSTART=1
       arg[03] : -DCONNECT_PORT=3055
       arg[04] : -DSAPSYSTEM=01
       arg[05] : -DSAPSYSTEMNAME=SID
       arg[06] : -DSAPMYNAME=hostname_SID_01
       arg[07] : -DSAPPROFILE=G:\usr\sap\SID\SYS\profile\SID_DVEBMGS01_hostname
       arg[08] : -DFRFC_FALLBACK=ON
       arg[09] : -DFRFC_FALLBACK_HOST=localhost
[Thr 5656] Tue Jan 09 16:43:35 2007
[Thr 5656] *** WARNING => INFO: Unknown property [instance.box.number=SIDDVEBMGS01hostname] [jstartxx.c   841]
[Thr 5656] *** WARNING => INFO: Unknown property [instance.en.host=hostname] [jstartxx.c   841]
[Thr 5656] *** WARNING => INFO: Unknown property [instance.en.port=3200] [jstartxx.c   841]
[Thr 5656] *** WARNING => INFO: Unknown property [instance.system.id=1] [jstartxx.c   841]
JStartupReadInstanceProperties: read instance properties [G:\usr\sap\SID\DVEBMGS01\j2ee\cluster\instance.properties;G:\usr\sap\SID\DVEBMGS01\SDM\program\config\sdm_jstartup.properties]
-> ms host    : hostname
-> ms port    : 3900
-> OS libs    : G:\usr\sap\SID\DVEBMGS01\j2ee\os_libs
-> Admin URL :
-> run mode   : normal
-> run action : NONE
-> enabled    : yes
Used property files
-> files [00] : G:\usr\sap\SID\DVEBMGS01\j2ee\cluster\instance.properties
-> files [01] : G:\usr\sap\SID\DVEBMGS01\SDM\program\config\sdm_jstartup.properties
Instance properties
-> ms host    : hostname
-> ms port    : 3900
-> os libs    : G:\usr\sap\SID\DVEBMGS01\j2ee\os_libs
-> admin URL :
-> run mode   : normal
-> run action : NONE
-> enabled    : yes
Bootstrap nodes
-> [00] bootstrap            : G:\usr\sap\SID\DVEBMGS01\j2ee\cluster\instance.properties
-> [01] bootstrap_ID18529600 : G:\usr\sap\SID\DVEBMGS01\j2ee\cluster\instance.properties
-> [02] bootstrap_ID18529650 : G:\usr\sap\SID\DVEBMGS01\j2ee\cluster\instance.properties
Worker nodes
-> [00] ID18529600           : G:\usr\sap\SID\DVEBMGS01\j2ee\cluster\instance.properties
-> [01] ID18529650           : G:\usr\sap\SID\DVEBMGS01\j2ee\cluster\instance.properties
-> [02] sdm                  : G:\usr\sap\SID\DVEBMGS01\SDM\program\config\sdm_jstartup.properties
[Thr 5656] *** WARNING => JsfOpenShm: ShmCreate (69, 312160, CREATE) failed(rc = 4 SHM segment already exists) [jsfxxshm.c   715]
[Thr 5656] *** ERROR => JsfOpenShm: Shm version mismatch (shm "JSF-ADM-CORRUPT", code "JSF-ADM-015") [jsfxxshm.c   761]
[Thr 5656] *** ERROR => Can't create shared memory segment 69 (rc = 8) [jcntrxx.c    1714]
[Thr 5656] *** ERROR => Can't initialize JControl Administration [jcntrxx.c    271]
[Thr 5656] JControlCloseProgram: started (exitcode = -1)
[Thr 5656] *** ERROR => JsfCloseShm: FiDetachIndex(SESSION) failed (rc = 6 invalid argument) [jsfxxshm.c   1243]
[Thr 5656] *** ERROR => JsfCloseShm: FiDetachIndex(ALIAS) failed (rc = 6 invalid argument) [jsfxxshm.c   1250]
[Thr 5656] *** ERROR => JsfCloseShm: FiDetachIndex(SERVICE) failed (rc = 6 invalid argument) [jsfxxshm.c   1257]
[Thr 5656] JControlCloseProgram: good bye... (exitcode = -1)
Thanks for your help
Regards
SM

Dear all,
We are setting up Diaster recover (DR ) where we are doing the mirror copy of the Source System to Target System.
After mounting all the files in Target DR System, i made the following changes in Target System.
OS: AIX
Dual stack System(ABAP +JAVA)
Instance number used :
00--ASCS00
02-- DVEBMGS02
01--SCS01
03--D03 --------------------------------------------------------------------------> It is maintained in another DR Server
Database Used: Oracle
a)renamed the Profiles (/usr/sap/KBP/SYS/profile).
b)Changed the dbenv files (/home/kbpadm) and (/home/orakbp)
c)set right permissions in all files and folders in /usr/sap.
d)Oracle is running and DB is also up
e)Started the profiles using sapcpe
e)After switching user (sidadm), Started the SAP Applications and SAP applications are up.
When i checked the GetProcess list according to instance wise, i am getting below output.
kbpadm> sapcontrol -nr 02 -function GetProcessList
31.07.2013 13:16:55
GetProcessList
OK
name, description, dispstatus, textstatus, starttime, elapsedtime, pid
disp+work, Dispatcher, YELLOW, Running, Message Server connection ok, Dialog Queue time: 0.00 sec, J2EE status info unavailable, 2013 07 31 11:26:41, 1:50:14, 14549078
rslgcoll, Central Syslog Collector, GREEN, Running, 2013 07 31 11:26:41, 1:50:14, 11141296
rslgsend, Central Syslog Sender, GREEN, Running, 2013 07 31 11:26:41, 1:50:14, 11862158
igswd_mt, IGS Watchdog, GRAY, Stopped, , , 13631708.
kbpadm> sapcontrol -nr 01 -function GetProcessList
31.07.2013 14:41:22
GetProcessList
OK
name, description, dispstatus, textstatus, starttime, elapsedtime, pid
msg_server, MessageServer, GREEN, Running, 2013 07 31 11:25:53, 3:15:29, 14614568
enserver, EnqueueServer, GRAY, Stopped, , , 14483586
kbpadm> sapcontrol -nr 00 -function GetProcessList
31.07.2013 14:41:55
GetProcessList
OK
name, description, dispstatus, textstatus, starttime, elapsedtime, pid
msg_server, MessageServer, GREEN, Running, 2013 07 31 11:26:17, 3:15:38, 10879188
enserver, EnqueueServer, GRAY, Stopped, , , 13041698
J2EE is not coming up. ALSO plz tel where to update 'system/type' .
There is a warning msg :
J2ee Startup: profile parameter 'system/type' not correctly set to start J2EE; use 'J2EE' for Java only and 'DS' for double stack instance
Server0 is not running.
Kindly Assist.
Regards.
Gayathri.K

How to view router/switch logs using LMS 3.2?

Of course I can log into each of my 100 routers and switches and peforms "sh loggin" to look for problems, but how do I use LMS 3.2 to consolidate all those logs into one location? Can I set up something so I can see those logs in more or less real time?
Thanks in advance.

>> Does LMS go get syslog messages periodically or does the device send a copy to LMS whenever it generates a new message?
The latter.
If for some reason, the devices cannot log directly to LMS, there're a few options: 1) Devices log to a central syslog server, which in turn exposes the syslogs to LMS' Syslog Analyzer, either via the Cisco-supplied Remote Syslog Collector or some unsupported methods such as NFS mount, or 2) Install Syslog-ng on the central syslog server, relay the logs to LMS, as described in this whitepaper: http://www.cisco.com/en/US/prod/collateral/netmgtsw/ps6504/ps6528/ps2425/white_paper_c11-571038.html
>> What's the benefit of scheduling a report to run automatically? Is it saved somewhere that is easier/quicker to get to?
It's the usual benefits of automation. Scheduled syslog reports apparently write outputs to /var/adm/CSCOpx/files/rme/cri/archives/syslog/reports/output/[jobID_runID], on Solaris, for example. The structure inside is rather muddy. So it might be easier to have something like a VBscript to screen-scrape the LMS web GUI for the report outputs instead.
>> Can new syslog messages from devices be posted to an RSS feed?
That's a novel idea. Though obviously not from the devices directly, it most likely coud be done through some "syslog2rss" relay residing on the syslog server. I think the potential volumes of logs could be too much for RSS, unless careful filtering/deduplication takes place on the relay before posting to a feed.

Can' t consume JMS messages from remote queue

Hello.
We are using Tibco JMS Server as Foreign JMS server from WL server. And WebLoigic (8.1 SP 3) MDBs are receivers. Everything works fine until there is a restart of the Tibco server. Once the queues become unavailabe, we see in the WL log that the destination is unreachable. And also once the Tibco server comes back up, WL log says that the Foreign queues have been re-connected. But still, we don't see any messages being received by the MDB. The MDBs are configured to poll for messages evey 1 second. Still we don't see it happening after the foreign server restart.
But if we re-start the WL server, it begins to work just fine.
Any pointers?
Thanks

I do have the correct IP address of the syslog server set up. I do not want email logs so have not enabled that.
My setup is
remote lan > SA520-remote (192.168.160.1) > [ site to site IPSec VPN over WAN ] > SA520-local (192.168.150.1) > syslog server (192.168.150.25) & local lan
Firewall is set up to allow ANY IN & OUT to local lan on both routers.
I have also set up specific rules for UDP 514 Syslog traffic (no difference, currently disabled)
syslog server has -no- firewall at the moment.
Syslog server is receiving messages from the local router with no issues.
Log Severity is set to Information & Log Facility is set up to send to Syslog.
I have also setup a SNMP trap on the syslog server & pointed the remote router to it in hopes of diagnosing the issue.
Both routers have the latest firmware applied.
Using wireshark on the syslog server I see no traffic on UDP 514 (syslog) or UDP 162 (snmp)
I can use the WUI for the remote & ping the 160.1 with no problem. Both ping & TLS/TCP traffic show up in wireshark on the syslog server when I do so.
It looks to me like there is a problem routing the syslog messages out of the router & then back through the VPN.
Worst case I'll set up another syslog server on an old machine at the remote location & then cron the logs to the central syslog server but it really seems I shouldn't have to.

Protection of SAP Log Files

Does anyone know of any tools (SAP or third-party) to protect SAP log files (system logs, security audit logs, etc.) from alteration by an authorized user (e.g., someone with SAP_ALL)? We are looking for an audit-friendly method to protect log files such that someone with SAP_ALL privileges (via Firefighter or special SAP userid (DDIC, SAP*)) can't perform actions and then cover up their tracks by deleting log entries etc. For example, we're wondering if any tools exist that enable the automatic export of the log files to a protected area (that's inaccessible to users with SAP privileges)? We'd certainly appreciate any advice or insight as to how to resolve this issue.
Regards,
Gail

For anyone who is interested, I wanted to pass along what we did (this was in response to an audit finding):
First, SAP_ALL access is restricted to monitored Firefighter accounts (we already had that in place). Recognizing that users with SAP_ALL and super-user access at the UNIX level (i.e., our Basis Team) can still circumvent pretty much any measure we take (e.g., can disable alerts in CCMS, delete batch jobs, deactivate Security Audit Log filters, delete Security Audit Log files, etc.), at least the actions would be captured via FF (although they could disable that as well) or other utilities at the UNIX level. And the more things the person has to disable/deactivate, the more likely it becomes that someone would notice that something was amiss.
Our company was already using SPLUNK to capture logs from other (non-SAP) systems so we decided to leverage that to capture and retain certain SAP Security Audit Log entries. We created a batch job on SAP that runs a custom program at 5 minute intervals to extract records from the Security Audit Log files into a UNIX file (the program includes some logic that uses timestamps in the UNIX file to determine which records to extract). The UNIX file is monitored by the UNIX tail-f command which is spawned by a Perl script. The output from the tail-f command is then piped to a file on a central syslog server via the logger command in the script. Finally, a SPLUNK process, which monitors syslog entries, extracts the information into SPLUNK real-time.
This process is not bulletproof as our Basis Team (with SU privileges at the UNIX level) could disable the Perl script or delete/change entries within the UNIX file. All we can really do is make it difficult for them to cover their tracksu2026
Gail

Central Syslog on Linux

Similar Messages

Maybe you are looking for