Solaris 9 syslog messages are IP not hostname
I am trying to setup Solaris 9 to forward its syslog messages to a central server, and its working fine except the logs being sent have the IP address and not the hostname. Is there a way to change this? Thanks
no, i mean you will need to put entries for the remote hosts on your central server, or set up IN NS records in your nameserver for reverse mappings from IP -> host (not host -> IP).
Shouldn't need any switches or config changes to syslogd for it to work.
Also, check your /etc/nsswitch.conf file has at least "files dns" set for hosts.
Similar Messages
-
Sent messages are sometimes not saved
Hello,
This is a follow up to this thread, which was never answered and is now archived:
http://discussions.apple.com/thread.jspa?threadID=2213207
In Mail.app, using IMAP, my sent messages are sometimes not saved. I'd say about 1 in 20 never appear in my Sent folder. The recipients always receive these messages, so it's not a delivery problem. I just don't retain a copy of them. This is very frustrating if I send a cost estimate to a client, or a detailed description of a technical problem that I need to refer back to later.
I've rebuilt my mailboxes and I've checked my IMAP folders on the server via a webmail interface, and the messages are not there.
Has anyone else experienced this? It's hard to believe I'm the only one, but it's hard to search for this problem because my search results are always full of people who have lost or can't save -any- of their sent messages. My problem is intermittent and random.
Thanks,
-ArloI have a similar occasional problem with an IMAP account using a Comcast Business Class Exchange server. I use Mail and my iPhone to access the account; I'm running OS X 10.6.4 on my laptop but my "sent messages" issue predates the latest release.
The first time I noticed this issue I thought, "I'll just access my mail via the Comcast web portal. It'll be in the 'sent' folder there." No dice. The "sent" messages simply never stay on the server, yet my recipients get them.
It's distressing. First, the solution would appear to be a switch to a MS mail client, which I swore off years ago. Second, I rely on having a "sent" message as a record. I switched off IDLE per your suggestion, Ernie, but otherwise I'm in the same boat as the others here. Please keep this thread alive. I'm hopeful that this can be resolved. -
don't know how I even got osx..I was on apple..now on icloud..don't want iclould cause my mail it Not going on AOL..messages(icloud messages only) are not delivered and in green not blue...address book messed up to...please help to get my phone back the way it was...want aol. mail n not iclound can't seem to change it......Camille
Let me take your side here. Call verizon billing and tell them you are cancelling the phone and service since you have not received it from Fedex. Verizon requires you to sign for their shipments from Fedex. The carrier then tries three delivery attempts and then sends the package back to verizon.
If you paid by credit card call up and dispute the charge, since your 14 days of previewing has not technically started as to return it within that time frame, just cancel the whole order. Make sure Verizon does not try to bill you .
Dispute, dispute and dispute.
You could have went into a verizon store and got your phone imediately instead of being shipped.
A lost or stolen phone not signed for by you or authorized person is verizons problem and not yours. You don't owe verizon for service not provided or the phone that was not delivered. Call your bank or credit card company and have them remove the charge. -
My
Reboot the iPad by holding down on the sleep and home buttons at the same time for about 10-15 seconds until the Apple Logo appears - ignore the red slider - let go of the buttons.
Or Quit the mail app completely and then launch it again. Go to the home screen first by tapping the home button. Double tap the home button and the task bar will appear with all of your recent/open apps displayed at the bottom. Tap and hold down on any app icon until it begins to wiggle. Tap the minus sign in the upper left corner of the app that you want to close. Tap the home button. Launch mail. -
LMS 4.2 not processing syslog messages
I have a new install of LMS 4.2 on a virtual appliance. No syslog messages are getting into LMS. They are being received by the server, but are showing up in /var/adm/CSCOpx/log/dmgtd.log, and aren't getting processed by SyslogAnalyser.
Here's the syslog.conf file:
local6.info /var/log/ade/ADE.log
*.info;mail.none;news.none;authpriv.none;cron.none;local0.none;local1.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg *
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
#Application LMS Generated config
#BEGIN CSCOmd - DO NOT EDIT THESE COMMENTS OR CONTENTS CONTAINED WITHIN - local0 1
local0.emerg;local0.alert;local0.crit;local0.err;local0.warning;local0.notice;local0.info;local0.debug /var/adm/CSCOpx/log/dmgtd.log
#END CSCOmd DO NOT EDIT BEFORE THIS LINE 1
local7.info /var/log/syslog_info
My guess is that the incoming messages are getting written to the wrong file. What do I need to change to correct this?I found that all of my syslog messages were being captured under /var/log/messages. This was due to my Cisco devices being configured with "logging facility local5". Instead of reconfiguring all of my devices to log to facility local7, I just changed the following line in syslog.conf and restarted (/etc/init.d/syslog restart)
Before:
local7.info /var/log/syslog_info
After:
local5.* /var/log/syslog_info
Probably not the best way to do it, but it worked for me.
-Rick -
Hello,
I have a newly installed LMS 4.1 that had the Syslog feature working for a while.
Recently, the Syslog is no longer displaying any records (neither new or old messages).
Below are the steps I have tried to troubleshoot the problem:
- Installed wireshark : Syslog messages are being received by the LMS server on time
- In the Syslog.log file, I can see that all the Syslog messages are being logged properly
- I tried to disable all the "Syslog Message Filters" but nothing changed
In the SyslogCollector.log, I can find the below logs:
NMSROOT is C:/PROGRA~2/CSCOpx
propFileC:/PROGRA~2/CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\C:\PROGRA~2\CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties
Unable to find the file C:/PROGRA~2/CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\C:\PROGRA~2\CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties
NMSROOT is C:/PROGRA~2/CSCOpx
propFileC:/PROGRA~2/CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:38,673, Logging System Initialized.
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:38,674, System Initialized.
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:38,684, Queue Cap 100000
SyslogCollector - [Thread: main] WARN , 04 Mar 2013 14:54:45,468, Unable to resurrect connection to a subscriber.
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:45,491, Service started...
I am not sure what to check now. Kindly your suggestions.
Thanks,
Justine.Hello,
I have a newly installed LMS 4.1 that had the Syslog feature working for a while.
Recently, the Syslog is no longer displaying any records (neither new or old messages).
Below are the steps I have tried to troubleshoot the problem:
- Installed wireshark : Syslog messages are being received by the LMS server on time
- In the Syslog.log file, I can see that all the Syslog messages are being logged properly
- I tried to disable all the "Syslog Message Filters" but nothing changed
In the SyslogCollector.log, I can find the below logs:
NMSROOT is C:/PROGRA~2/CSCOpx
propFileC:/PROGRA~2/CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\C:\PROGRA~2\CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties
Unable to find the file C:/PROGRA~2/CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\C:\PROGRA~2\CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties
NMSROOT is C:/PROGRA~2/CSCOpx
propFileC:/PROGRA~2/CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:38,673, Logging System Initialized.
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:38,674, System Initialized.
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:38,684, Queue Cap 100000
SyslogCollector - [Thread: main] WARN , 04 Mar 2013 14:54:45,468, Unable to resurrect connection to a subscriber.
SyslogCollector - [Thread: main] INFO , 04 Mar 2013 14:54:45,491, Service started...
I am not sure what to check now. Kindly your suggestions.
Thanks,
Justine. -
Unterstanding syslog messages from our wlc
Hello,
we use two wlc 4402 (4.1.181.0) and several leightweight accesspoints (AIR-AP1010-E-K9 and AIR-AP1030-E-K9 ) connected to them.
On our syslog server we get a lot of messages from the two wlc, and there are 3 message types which I am a little bit afraid of.
1. ca. 10 times per hour we get the message
apf_80211.c:4792 APF-6-NO_CONFIG_CHANGES: Not saving 'apf.cfg' - no config changes."
Cisco system message guide:
Error Message %APF-6-NO_CONFIG_CHANGES: Not saving '[chars]' - no config changes.
Explanation Not saving - no config changes.
Recommended Action No action is required.
Does anybody know why we get this messages and if it's possibly to suppress them?
2. Intermittently (several times a day) we get the following message types:
a) [ERROR] spam_l2.c 723: Max retransmissions reached on AP 00:0B:85:56:63:40 (CONFIGURE_COMMAND^M , 2)"
b) [ERROR] spam_tmr.c 569: Did not receive hearbeat reply from AP 00:0b:85:56:ae:40"
The MAC address is not every time the same but one of our accesspoints.
On our network management system we get the following trap messages with nearly exactly the same timestamp:
14.01.2008 04:21:56 CET
AP ''00.0b.85.56.63.40'', interface ''0x1'' is down.
When Airespace AP's interface operation status goes down this trap will be sent.
bsnAPDot3MacAddress = 00.0b.85.56.63.40
bsnAPIfSlotId = 0x1
14.01.2008 04:21:56 CET
AP disassociated from Switch.
When an Airespace AP disassociates from a Airespace Switch, the AP disassociated notification will be sent with the dot3 MAC address of the Airespace AP. This will notify the management system to remove Airespace AP from this Airespace Switch.
bsnAPMacAddrTrapVariable =
14.01.2008 04:22:25 CET
AP associated with Switch.
When an Airespace AP Associates to a Airespace Switch, the AP associated notification will be sent with the dot3 MAC address of the Airespace AP. This will help the management system to discover the Airespace AP and add it to system.
bsnAPMacAddrTrapVariable =
bsnAPPortNumberTrapVariable = 1
Cisco system message guide:
a) Error Message %LWAPP-3-TX_ERR3: Max retransmissions for LWAPP control message reached on AP [hex]:[hex]:[hex]:[hex]:[hex]:[hex] for [chars] (number of pending messages is [dec])
Explanation Maximum number of times an LWAPP control packet is transmitted before declaring the AP dead has been reached for this AP. The AP may not be on the network, or might have rebooted.
Recommended Action Check if the AP has rebooted or if it has been removed from the network, or if there are connectivity issues between the AP and the controller.
b) Error Message %LWAPP-3-ECHO_ERR: Did not receive heartbeat reply; AP: [hex]:[hex]:[hex]:[hex]:[hex]:[hex]
Explanation Controller did not get a response for the AP heartbeat message. There may be connectivity issues between the AP and the controller.
Recommended Action Check if the AP has rebooted or if it has been removed from the network, or if there are connectivity issues between the AP and the controller.
Because we don't see any network problems I'm wondering why the connection is lost.
Does anybody have an idea, perhaps CSCsh13928 (http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsh13928, but we don't have much traffic on the wlans) ?
Is there any possibility to remotely check if the accesspoint rebooted?
If you need further information please give me a short feedback.
Many thanks in advance,
Thorsten SteffenThanks for the help.
I have set up to send email and syslog messages from the RME applications. LMS server immediately started to send messages to the email server but syslog messages are not forwarded to the syslog server. Everything was done according to your instructions except that the name of the first script (syslog_forward.pl) is made consistent with what the second script (.bat) refer to (forward1.pl). What's the problem? Do RME sends the standard syslog messages via UDP port 514?
Sincerely. -
Snmp trap versus syslog message
Hi,
Most network devices will send snmp traps and syslog messages to a central server.
For analyzing purpose this server runs software to display the messages or traps.
My question is, what is the difference between syslog messages and snmp traps?
What is best practise?
Thank you very much.
HansruediFrom the very basic level, traps and syslog differ in the encoding. Syslog messages are typically text messages sent within a UDP packet. There is a bit of binary encoding to indicate the syslog facility and severity. SNMP traps have encoded ASN.1 fields (called variable bindings). These varbinds are not ASCII text like syslog messages. Instead they are encoded object identifiers that can be translated into object names using MIB definitions.
More syslog messages exist than SNMP traps because syslog messages do not have as much governance associated with them. However, we typically recommend that customers enable both as there are some details available in traps that you may not get in syslog messages. Traps can also be processed in a more programmatic fashion because of the documentation that goes into the MIBs that define them. -
Cisco EEM script to detect a sequence of SYSLOG messages
Hi,
I am trying to create an EEM "Port-knocking" script which should act upon an ordered sequence of SYSLOG messages. The SYSLOG messages are generated by some "deny tcp any any XXX log STRING" ACLs, applied to the outside interface.
Here is what I have already tried:
! <------- BEGIN ------->
ip access-list extended INTERNET
deny tcp any any eq 1234 log OPEN_SEQUENCE_A
deny tcp any any eq 1235 log OPEN_SEQUENCE_B
deny tcp any any eq 1236 log OPEN_SEQUENCE_C
event manager environment 1ST_MATCH 0
event manager environment 2ND_MATCH 0
event manager applet ONE
event syslog pattern "OPEN_SEQUENCE_A"
action 1 set 1ST_MATCH "1"
action 2 syslog msg "DETECTED SEQUENCE A!"
event manager applet TWO
event syslog pattern "OPEN_SEQUENCE_B"
action 1 if $1ST_MATCH eq 1
action 2 set 2ND_MATCH "1"
action 3 syslog msg "DETECTED SEQUENCE B!"
action 4 end
event manager applet THREE
event syslog pattern "OPEN_SEQUENCE_C"
action 1 if $1ST_MATCH eq 1
action 2 if $2ND_MATCH eq 1
action 3 syslog msg "DETECTED SEQUENCE C!"
action 4 syslog msg "PORT KNOCK SUCCESSFUL! UNLOCKING!..."
action 5 end
action 6 end
! <------- END ------->
In the above I am somehow trying to "chain" the syslog events, yet I do not seem to be able to pass any information between the applets.
Any comments are highly appreciated.
Cheers,
DavidEEM cannot detect syslog messages that it generates. If you want to chain together events across multiple applets, use application-specific events. For example:
action 2 publish-event sub-system 798 type 1
event application sub-system 798 type 1
action 3 publish-event sub-system 798 type 2
You can also pass up to four arguments as well if you need additional context. -
Can we have two message area UI controls in the same view (one at the Top and the other at the bottom section) and ensure that the messages are displayed at both places?
Requirement reason:The View is a very big form which the user has to fill in, and the messages need to displayed at the top and bottom section of the screen so that the user does not have to scroll and can see the messages at both places.
Currently, the message is displayed at the first (top) message area and not the bottom message area.
Thanks,Hai,
you can focus the Message Area UI element for those big screens.
view.getElement("MessageArea").requestFocus();
create a context attribute is Focus of type boolean.
like in Exception block
wdComponentAPI.getMessageManager.reportException("some Statement",false);
wdContext.currentContextElement.setIsFocus(true);
in
wdDOModify(){
if(wdContext.currentContextElement.getIsFocus()){
view.getElement("MessageArea").requestFocus();
wdContext.currentContextElement.setIsFocus(false);
Like this you can manage Big screens for Messages.
Regards,
Naga -
Cisco ASA Connection Denied syslog messages
Hi,
Could you please provide the connection denied syslog messages, I'm not able to differentiate the messages from syslog guide
Regards,
ShalendraHi Shalendra,
For TCP connection denied syslog , 106001 is the id.
For protocol denied connection, 106002 is the id.
For connection denies due to logging permit-hostdown policy, 414006 is the id.
Refer to this link:
http://www9.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs/logsevp.html#13063
Regards,
Shrinkhala -
ESS's LeaveRequest Message Area Modification
Hi,
I'm working on ESS's LeaveRequest application. There is a request to change the Message Area (which display error, confirmation msg etc), due to it's position in the browser was messed up if viewing with different monitor's resolution.
1. The message area is not in the ess/lea source codes. Which DC's source code that i need to get in order to change Message Area?
2. Any suggestion on how to solve the Message Area's position issue, to make it same acroos the different monitor's resolution?
Any help would be much appreciated. Point would sure be awarded for helpful info.
Thanks.
- juliusYou need to check the badi HRPAD00INFTYBL
or
IF_EX_HRPAD00INFTYBL~INSERT_COMPUTATIONS"
Are you implementing the HRPAD00INFTYUI and HRPAD00INFTYDB badis
http://wiki.sdn.sap.com/wiki/display/ERPHCM/ValidationsforESSLeaverequest -
HL7 Messages are not transforming.
Hi,
My composite is picking HL7 message from file adapter and i want to insert some of few elements in database. After transformation null values goes in database. If i give hard code values like current date, then it get inserted properly in database. I tested mediator transformation values by using test button in mediator transformation , that time it showing all the values properly.
Composite flow is like this,
(Picking HL7 ADT_28 Messages)File Adapter------------->Mediator--------------->Database Adapter
Thanks,
Shrikant.HI,
Whenever we set the sender communication channel as FTP/NFS and Quality of Service as Exctactly Once in Order , such
mesasges will process through the Adapter engineEOIO sequence monitoring tool.
Sometimes, the status of the messages in the message monitoring of the adapter framework is Holding status.
To clear the holding status messages from Adapter engine we need to follow the step by step procedure as mentioned below.
Step 1.
http://hostname:port/MessagingSystem --->click on EOIO Sequence monitor.
If messages are stuck then you can see HOLD and NDLV status.
HOLD reprasents holding the messages in adapter engine in EOIO queue.
NDLV reprasents the messages not delivered to Integration Server.
To clear these messages click on the message key number.
Step 2:
Click on the redeliver button and see the status. If messages still not process then we need to cancel the failed message by clicking on Delete option.
refer the below links
http://www.saptechies.com/how-to-deal-with-stuck-eoio-messages-in-the-xi-30-adapter-framework/
thanks and regards,
kesava. -
Sent Messages are not saved in Sent Mailbox
It was working correctly but suddenly all my sent messages are not saved in the Sent Mailbox. I follow all the Mail Help instructions but nothing seems to work. Hope that someone can help me. I asked for help on december 14 but it was not helpful
The mailboxes drawer contains all mailboxes under In, Drafts, Sent, Trash and Junk (if you have Junk Mail set to automatic).
If you have a .Mac or IMAP type account, you also have an account named icon for the .Mac or IMAP type account at the bottom of the mailboxes drawer. It is named by the Account Description you provided/entered for the account under the Account Information tab for the account preferences.
If you select save Sent messages on the server for a .Mac or IMAP type account, the account's Sent mailbox will be available under the account named icon in the mailboxes drawer along with all other server stored mailboxes.
To open the account named icon for your .Mac account to reveal the server stored mailboxes including the account's Sent mailbox, select the black triangle beside your .Mac account icon in the mailboxes drawer pointing it down.
Select the account's Sent mailbox and at the menu bar, go to Mailbox > Use This Mailbox For and select Sent.
If you deselect store Sent messages on the server for the account preferences, the account's Sent mailbox will be available under Sent in the mailboxes drawer and you can't use "Use This Mailbox For" for mailboxes stored locally on the hard drive. It can only be used for .Mac or IMAP type account mailboxes that are stored on the server. -
I can't sync my iphone to itunes i get this error message "Iphone could not sync because the sync failed to start" Help? both my computer windows and my phone are on the current versions of ios and itunes
Hello lenmin,
Thanks for using Apple Support Communities.
To help resolve this issue where you're repeatedly prompted to authorize with your Apple ID in iTunes when syncing, please follow the directions in the article below.
iTunes: Missing folder or incorrect permissions may prevent authorization - Apple Support
Have a great weekend,
Alex H.
Maybe you are looking for
-
After itunes 11 update, my music is getting continually corrupted.
So the other day, I updated Itunes to 11.0.2 on Win7. After rebooting, I open iTunes and for some reason, it wanted to scan my entire computer for 'music files' as if I had no library (lies). I let it do it's thing since I had no other option and it
-
Hi guys, I have a requirement in Automatic payment program. Say we have 3 house banks and a payment method C. Right now when I run F110 , the system will pick up the house bank from the ranking order. But I want to give the user the option to select
-
Norton isn't supported on Firefox 4. I don't trust ANY web browser that I can't use Norton on. I had no complaints with it when I had Firefox 3.6. I want to reinstall 3.6 but can't. I have looked all over for a download but every one comes back to Fi
-
Single Threaded Model JSP- Servlet
Servelts can be set to have thread safe access (Single thread model). However, when a JSP is converted in to a servlet, is the servlet tagged as to use the single thread model?
-
Ran migration assistant. Do not like having to sign in to either pc or Mac at start up What can I do?