LMS 4.2 – Missing messages in Remote Syslog Collector

Question

Remote syslog Collector are dropping syslog messages - randomly. During analyzing we found out that syslog messages are stored in RSAC in file: /var/log/syslog_info
According to information from /etc/rsyslog.conf are the same syslog messages stored again in other files: /var/log/messages, /var/log/boot.log
In every file are missing the same messages. Load of RSAC and physical server is very low. When we send messages to more syslog servers (for example to other debian server in the same or different vlan) in the same physical server in vmware, we always receive every message.
We are using LMS 4.2.3 (Soft appliance) and for syslog messages RSAC 5.2 (linux in vmware). We receive approximately 200-300k syslog messages per day and RSAC drop approximately 100k.
Please what we have to change to receive all messages?
Why RSAC store the same messages more times?
Thanks
Milos

Answer 1

I think this should change what you want - if not, revert it to the default:
for security, make a backup of the following file and open it in a text editor:
NMSROOT\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties
change the following to a value that might fit your needs but be careful this can affect system performance:
    QUEUE_CAPACITY=100000
save the file and restart the following syslog processes:
in a DOS box check the status of the following processes (they should be started) and restart them:
    pdshow SyslogAnalyzer SyslogCollector
    pdterm SyslogAnalyzer SyslogCollector
    pdexec SyslogAnalyzer SyslogCollector
    pdshow SyslogAnalyzer SyslogCollector
now, try to re-run your report.