Ciscoworks LMS 4.2.2 keeps sending icmp to a specific IP

Hi All,
I got the following logs from the syslog server. My Ciscoworks LMS 4.2.2 (IP 10.26.73.1) keeps sending icmp to 128.100.3.221 and generated tons of logs. I checked the Ciscoworks but couldn't locate the IP of 128.100.3.221. Please help me stop the ICMP on the Ciscoworks. Thanks in advance.
1                            2013/06/18 15:12:33.839 EDT            10.26.0.9               Jun 18 2013 15:12:31: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
2                            2013/06/18 15:12:42.105 EDT            10.26.0.9               Jun 18 2013 15:12:39: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
3                            2013/06/18 15:12:44.918 EDT            10.26.0.9               Jun 18 2013 15:12:42: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
4                            2013/06/18 15:12:49.512 EDT            10.26.0.9               Jun 18 2013 15:12:46: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
5                            2013/06/18 15:13:18.562 EDT            10.26.0.9               Jun 18 2013 15:13:15: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
6                            2013/06/18 15:13:19.234 EDT            10.26.0.9               Jun 18 2013 15:13:16: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
7                            2013/06/18 15:13:30.985 EDT            10.26.0.9               Jun 18 2013 15:13:28: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
8                            2013/06/18 15:13:31.361 EDT            10.26.0.9               Jun 18 2013 15:13:28: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
9                            2013/06/18 15:13:52.144 EDT            10.26.0.9               Jun 18 2013 15:13:49: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
10                          2013/06/18 15:13:59.692 EDT            10.26.0.9               Jun 18 2013 15:13:57: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
11                          2013/06/18 15:14:33.727 EDT            10.26.0.9               Jun 18 2013 15:14:31: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
12                          2013/06/18 15:14:42.103 EDT            10.26.0.9               Jun 18 2013 15:14:39: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
13                          2013/06/18 15:14:45.697 EDT            10.26.0.9               Jun 18 2013 15:14:43: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
14                          2013/06/18 15:14:49.213 EDT            10.26.0.9               Jun 18 2013 15:14:46: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
15                          2013/06/18 15:15:19.169 EDT            10.26.0.9               Jun 18 2013 15:15:16: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
16                          2013/06/18 15:15:19.294 EDT            10.26.0.9               Jun 18 2013 15:15:16: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
17                          2013/06/18 15:15:30.467 EDT            10.26.0.9               Jun 18 2013 15:15:27: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
18                          2013/06/18 15:15:31.592 EDT            10.26.0.9               Jun 18 2013 15:15:28: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
19                          2013/06/18 15:15:52.673 EDT            10.26.0.9               Jun 18 2013 15:15:50: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
20                          2013/06/18 15:15:59.720 EDT            10.26.0.9               Jun 18 2013 15:15:57: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.205 (type 8, code 0)
21                          2013/06/18 15:16:34.334 EDT            10.26.0.9               Jun 18 2013 15:16:31: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)
22                          2013/06/18 15:16:42.428 EDT            10.26.0.9               Jun 18 2013 15:16:39: %ASA-3-106014: Deny inbound icmp src inside:10.26.73.1 dst inside:128.100.3.221 (type 8, code 0)

You can unmanage or remanage device components using the Detailed Device View (cards, interfaces, ports, IP addresses, and so forth). If you unmanage a component, LMS will ignore subsequent events (including traps).
You can check the details here :
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.2/user/guide/lms_monitor/mnt-fault.html#wp1586744

Similar Messages

CiscoWorks LMS 3.2 Not sending mail

HI,
I have got a CiscoWorks LMS which is not sending mail for HUM reports.
Here's the log that I receive when it is supposed to send the mail in smtp.log
[ Sun Oct 16 13:17:42 CAT 2011 ] INFO [MailUtility : isMailServerWorking] : The mail server [10.102.247.57] is responding
I can telnet to the server port 25. No authentication is required for sending mail to local domain.
There is a MacAfee Agent but it is configured to send mail.
I don't have a clue what is causing it.
Could you please help.
Thanks,
Ashley

Hi,
Are other email messages being sent as expected?
Do you have a size limit defined under CS > Server > Admin > System Preferences?
Have you verified the email leaves the LMS server?
Are there any related logs on you mail server?
Does the condition persist when you disable any host firewall and anti-virus agents?
Try some debugging:

CiscoWorks LMS not sending mail

Hi,
I have CiscoWorks LMS functionning properly. For some time, I am seeing problems with it sending mail notifications. When it is rebooted, it sends the mail properly but after some time, the mail notifications are not sent.
Is there a log file to see the issue with the mail sending? I am not sure whether it is a CiscoWorks LMS issue or the mail server (on which i have no access) to try to isolate the problem.
The last change that I made to the server, that might be a possible cause. I had installed the HP NIC teaming with 2 NIC cards teamed and assuming the IP address of the server.
I just want to check with the server before proceding to mail server blacklisting or other.
Thanks in Advance,
Ashley

Sorry,
Hi,
I have CiscoWorks LMS functionning properly. For some time, I am seeing problems with it is not sending mail notifications. When it is rebooted, it sends the mail properly but after some time, the mail notifications are not sent.
Is there a log file to see the issue with the mail sending? I am not sure whether it is a CiscoWorks LMS issue or the mail server (on which i have no access) to try to isolate the problem.
The last change that I made to the server, that might be a possible cause. I had installed the HP NIC teaming with 2 NIC cards teamed and assuming the IP address of the server.
I just want to check with the server before proceding to mail server blacklisting or other.
Thanks in Advance,
Ashley

Ciscoworks LMS 4.0 DFM Custom Traps

Hello,
We want to use Ciscoworks LMS 4.0 for Access Control List Monitoring. i.e. if we end the ACLs with "log" entry, we may send the ACL deny logs to the Ciscoworks as Syslog or Snmp Trap format.
With "debug snmp packets" command we may observe the packets are sent to the LMS, but the traps don't show up as alarms. Is it possible to observe any trap entry with LMS DFM Fault Manager by customizing the module, because we think the engine of the DFM analyzes the traps and shows some of the traps, not all of the traps are observable.
The command output is as below:
Thanks in Advance,
Best Regards,
Mar 2 10:28:30.028: SNMP: Queuing packet to 10.10.10.1
.Mar 2 10:28:30.028: SNMP: V1 Trap, ent ciscoSyslogMIB.2, addr 10.10.20.1, gen trap 6, spectrap 1
clogHistoryEntry.2.742 = SEC
clogHistoryEntry.3.742 = 7
clogHistoryEntry.4.742 = IPACCESSLOGDP
clogHistoryEntry.5.742 = list 191 denied icmp 10.10.10.1 -> 10.10.20.1 (0/0), 10 packets
clogHistoryEntry.6.742 = 69082382

DFM consumes the traps and decides based on its built-in code-book what to do - rise one of the predefined Events or just silently ignore it. The best DFM can do is forward the trap as-is to another trap receiver.
Perhaps the LMS Syslog-Server can do what you want and lauch automated actions (like scripts or e-mail) based on certain criteria.
But you should take care of the underlying syslog file and keep its size under control with logrot.pl utility.
The online help of LMS should give you more details on the syslog capabilities or this link to the LMS 4.0 Administration Guide:
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.0/user/guide/admin/useNotif.html#wp1075603

Ciscoworks LMS 4.0 – Email Notifications Issue

We currently use Ciscoworks LMS 4.0 with over 1000 devices in the database. I'm a LMS novice. And have been assigned the task of minimising the amount of email notification’s we receive, as if one device goes Operationally Down all devices off that switch also send alerts to the email notification group, which in turn overwhelms the mailbox.
The ports are configured not to log or send snmp traps.
no logging event link-status
no snmp trap link-status
So any advice on how we can limit these alerts being generated would be much appreciated.
Thanks in advance.

Hi Nessie,
Go to Monitor > Fault Settings > Setup > Fault Device Details
select the device and click on view then Click on the hyperlink or the device name\ip address
that will bring a new window from there click on Interface and chanaged the Managed state from ture to FLASE for those interfaces for which you do not want ALERTS.
Thanks-
Afroz
[Do rate the useful post]

CiscoWorks LMS 4.0.1 - some questions

Hello community,
I would like to ask some questions about CiscoWorks LMS 4.0.1.
We are using for a few days, and I can't set some request in the system. I hope someone could help me to customize the CW as I would like to use it.
- We have some Catalyst 6500s, and between them there are Etherchannels. CiscoWorks sends us email because HighUtilization, and it relies on a Gi interface. I read that CW doesn't support etherchannels, is this true.
- I would like to receive email notifications about errdisabled state, etc. I know this is dome by RME, not DFM. The CiscoWorks server acts as Syslog server, too, and it collects the syslogs. I see in the Syslog summary, that the device sends to CW the syslog, but I can't receive email. I did an automated actions, (Monitor-Syslog-Automated actions), I defined the parameters (Facility: *, Sub-facility: *, Severity: 2, Mnemonic: PSECURE_VIOLATION, Description: *), but CW doesn't send me an email.
- I would like to customize interface threshould parameters per device. We have some router with Tunnel utilization 90%, but it's okay because we have a 10Mbit line for the external site. But when our distribution switch ethernet utilization would be 90%, it would be critical. Where can I set these parameters per device/interface?
Thank you for your help in advance.
Ferenc KURIS

If you go to Monitoring > Fault Settings > setup > fault device details
Select the device click view and click the device to open the detailed device view.
There you may see the tu interface under interfaces and set it to managed.
Cheers,
Michel

CiscoWorks LMS: not receveing certain SNMP traps

CiscoWorks LMS 4.0.1 (I know it's old and unsupported).
Problem: not receiving certain SNMP traps.
For example: I receive trap like "STP new root" but not like "port put to err-disabled" or my custom traps (produced by EEM scripts).
I've investigated my situation and found out that switch sends traps and they reach* LMS but somehow LMS ignores them (there's no trace of them in GUI). I've read that some traps just pass through LMS but my traps are very important and I need to know about them.
* I did Wireshark capture on LMS machine.
I'd like to know how to debug receiving of SNMP traps in LMS:
which specific debugs need to be enabled,
which specific log files need to be examined.

LMS uses DFM to process certain traps.
All traps it deems unimportant are dropped.
If you want to use the LMS GUI you can have you device send a SYSLOG message rather than a trap.
use logging source command to make the management interface send the message.
Then there is a GUI that allows you to launch an action on a message
Cheers,
Michel

HT1937 I have an iTunes gift card but can't use it. I can't remember my security questions and it keeps sending an email to an old email account which I don't use any more. How do I fix this?

I am wanting to use my iTunes gift card but it says that I have to verify my account. I thought I had already done this. It says I have to answer two security questions but I can't remember the answers to the questions. When I go to change the answers to something I will remember It keeps sending the email to an old email account. How do I change this. It is very annoying

You need to ask Apple to reset your security questions; ways of contacting them include clicking here and picking a method for your country, phoning AppleCare and asking for the Account Security team, and filling out and submitting this form.
(96909)

HT1386 I can't synchronise phone 5s with mac book pro. mac message me : the i phone could not be synchronised because this computer is no longer authorised for purchased items that are on this i phone. then go and authorised mac but keep send me the same

I can't synchronise phone 5s with i tunes . mac message me : the i phone could not be synchronised because this computer is no longer authorised for purchased items that are on this i phone. then go and authorised mac but keep send me the same message.

Hi john,
Follow the troubleshooting steps in this article:
http://support.apple.com/kb/ts1389
Cheers,
GB

I just got the new Iphone 5 and when I send a message in a group text it keeps sending it as an email and as my phone number. The people in the group text are complaining that it is creating a new group message everytime I text. How do I fix this?

I just got the new Iphone 5 and when I send a message in a group text it keeps sending it as an email and as my phone number. The people in the group text are complaining that it is creating a new group message everytime I text. How do I fix this?

Read http://macmost.com/setting-up-multiple-ios-devices-for-messages-and-facetime.htm l
If you wish to share an Apple ID with family members then read: http://www.macstories.net/stories/ios-5-icloud-tips-sharing-an-apple-id-with-you r-family/

SharePoint 2013 - SPD Custom Workflow keeps sending multiple emails for a single Task

I have a workflow triggering on List item created only. There are multiple stages in the work flow and in each stage a single task is assigned to a group of people. Currently group is only having one user i.e. my own test user with a valid email address.
Workflow was running fine for first 5 runs but now it keeps sending multiple emails for each task multiple times and runs very slow. I have only single workflow in development server with 24GB RAM.
Enabling the Workflow log in Event viewer does not show any error or warnings. The only clue I see is WorkFlowManager Database table "DebugTrace" having multiple entries showing that WF is trying to send same email multiple times with failed attempts,
but in reality emails are being delivered as well.
http://server/site/_vti_bin/client.svc/sp.utilities.utility.SendEmail Retry sending email in xx.xx.xx Status: HTTPRetrying
http://server/site/_vti_bin/client.svc/sp.utilities.utility.SendEmail Retry sending email in xx.xx.xx Status: HTTPFailed
I could not get the exact phrase as I don't have direct access to development machine at work.
Any help or guidance will be highly appreciated.

Yes, I have on-premise SP site, and here is the actual log I see in DebugTraces table.
Message              Level     Name    Category
Attempt 1 of the HTTP request to 'http://site/collection/_vti_bin/client.svc/sp.utilities.utility.SendEmail' failed with response '<Exception.
No Status Code>'.              2              HttpRequestFailed          Http
Attempt 2 of the HTTP request to 'http://site/collection/_vti_bin/client.svc/sp.utilities.utility.SendEmail' will be made in 00:00:06.
2              HttpRequestRetrying     Http
Attempt 2 of the HTTP request to 'http://site/collection/_vti_bin/client.svc/sp.utilities.utility.SendEmail' failed with response '<Exception.
No Status Code>'.              2              HttpRequestFailed          Http
Attempt 3 of the HTTP request to 'http://site/collection/_vti_bin/client.svc/sp.utilities.utility.SendEmail' will be made in 00:00:07.
2              HttpRequestRetrying     Http
Attempt 3 of the HTTP request to 'http://site/collection/_vti_bin/client.svc/sp.utilities.utility.SendEmail' failed with response '<Exception.
No Status Code>'.              2              HttpRequestFailed          Http
Attempt 4 of the HTTP request to 'http://site/collection/_vti_bin/client.svc/sp.utilities.utility.SendEmail' will be made in 00:00:09.
2              HttpRequestRetrying     Http
Attempt 4 of the HTTP request to 'http://site/collection/_vti_bin/client.svc/sp.utilities.utility.SendEmail' failed with response '<Exception.
No Status Code>'.              2              HttpRequestFailed          Http
Attempt 5 of the HTTP request to 'http://site/collection/_vti_bin/client.svc/sp.utilities.utility.SendEmail' will be made in 00:00:13.
2              HttpRequestRetrying     Http

What to do?? -What to do?? - I just updated my iTunes to ver 11.2.1 because of the annoying messages they keep sending out. Now I can't play the movies and TV series I've purchased and were watchable before - This movie can be played only on displays that

What to do?? - I just updated my iTunes to ver 11.2.1 because of the annoying messages they keep sending out.
Now I can't play the movies and TV series I've purchased and were watchable before.
Comes up with "This movie can be played only on displays that support HDCP (High-bandwidth Digital Content Protection)."
The cheek of the matter is everytime I tried to get Apple support it comes up with a request for me to pay $54 for their support package, to fix a problem I didn't have until I complied to one of their update requests.
End of Rant!!! - Anyone know how to fix please?

Well, I wonder about all the responses...:)
Anyhow, I wound up "fixing" the problem by using the System Restore disks for the Mini. It's now running Tiger 10.4.11 (with all updates) and I copied my iTunes library over. It all works now. <shrug> I have no idea what the problem was, and I'm a bit leery of upgrading it to Leopard, so I think I'll just leave well enough alone.
Richard

How do you install RSAC 4.3.2 when upgrading to ciscoworks LMS 3.2.1?

We have ciscoworks LMS 3.2 which we have recently updated to ciscoworks 3.2.1 using the ciscoworks 3.2 Service Pack 1 patch file. In the "Readme for CiscoWorks LAN Management Solution 3.2 Service Pack 1" document, it says that you have to install the Remote Syslog Collector 4.3.2 separately. It says the file (setup.exe) is located at disk1/RSAC. However, ciscoworks 3.2 Service Pack 1 only appears to be a patch file and when we ran the patch file on our Remote Syslog Collector server, the version remained at 4.3.0. When I looked at the server where RME is installed (version 4.3.2), it says that Syslog Analyzer is 4.3.2 and Syslog Collector is version 4.3.0. The patch file doesn't look like it has the installation files for RSAC 4.3.2 and there doesn't seem to be a directory that was created on the RME server to install the updated RSAC from, so how do you upgrade from RSAC 4.3.0 to RSAC 4.3.2?

I opened up a TAC case, worked with TAC, and was able to update RSAC to version 4.3.2. The procedure is:
1. Download the ciscoworks LMS 3.2.1 patch file to the remote syslog server.
2. Create a temporary directory on the remote syslog server (ex. c:\test)
3. Go into the directory with the extracted LMS 3.2.1 patch file and type the command:
Ciscoworks_LMS_3.2.1.exe /extract_all:c:\test
4. Go into the c:\test directory and find the RSAC folder. In the RSAC folder is a setup file. Run setup and install RSAC 4.3.2 over RSAC 4.3.0 (if you uninstall RSAC 4.3.0, you will get a message saying that RSAC 4.3.0 must be installed before installing RSAC 4.3.2)
5. Check the installation by going to Common Services->Software Center->Software Update on the remote syslog server. The version should be RSAC 4.3.2.

My iPhone 5 charger stopped working. It's under warranty and I want to send it back. How do I initiate that process? The website keeps sending me in circles. I'm getting an error message when I put in my serial number. Why is this so difficult?

My iPhone 5 charger stopped working. It's under warranty and I want to send it back. How do I initiate that process? The website keeps sending me in circles. I'm getting an error message when I put in my serial number. Why is this so difficult?

If posible you will find visiting a store by far the simplest way of getting a solution
Which Country
are you in ?
Have you checked the lightning socket on iPhone doesn't have lint or fluff in it
solves majority of such issues

I keep getting prompts to update my Firefox to 4.0.1 but I already use 4.0.1. What's wrong with Firefox that it keeps sending these?

I keep getting prompts to update my Firefox to 4.0.1 but I already use 4.0.1. What's wrong with Firefox that it keeps sending these prompts and what can I do to stop them?

I keep getting prompts to update my Firefox to 4.0.1 but I already use 4.0.1. What's wrong with Firefox that it keeps sending these prompts and what can I do to stop them?

Ciscoworks LMS 4.2.2 keeps sending icmp to a specific IP

Similar Messages

Maybe you are looking for