Syslog Issue in RME

Hi ,
I am able to see sylog messeges if I enable snmp syslog traps in my device. but not able to generate syslog messages report in RME , I have already enabled logging commands with LMS IP and default port 514 in my devices, all other syslog services are also running fine., I have also enabled syslog backup policy with default path.
Pls find the attached logs and kindly check where may be the isuue.
Rgds,
Kamal Singh
9910213708

I do not see any Cisco syslog messages in this syslog.log file. If you have logging enabled on the devices, make sure that udp/514 is open between the device and the LMS server. To verify that the messages are making it to the server, start a sniffer trace on the LMS server filtering on udp/514 traffic. Generate some messages from a test device, and confirm that you see those messages in the sniffer trace. If not, check with your firewall or network administrators to make sure there are no filters or ACLs which could be blocking this traffic.

Similar Messages

LMS 4.2.4 intermittent Syslog issue

Hi All,
syslogs services on the LMS stops all of a sudden and doesn't reflect the current logs from the devices till we restart services.
Performed below steps
-> Found the device logs are making its way to syslog.log file(CSCOpx>logs)
-> SyslogCollector and SyslogAnalyzer are in healthy state.
-> Even the collector subscription status is fine.
After the restart of the SyslogCollector and SyslogAnalyzer the logs reflects back on lms. Issue is intermittent and reappeared couple of times. any suggestions to find root of the problem ??
Regards,
Channa

Hi Channa,
looks like , you are getting huge no. of syslogs from your devices..
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,389, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,390, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,390, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,391, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,392, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,393, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,393, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,394, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,394, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,395, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,396, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,396, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Jul 2014 16:53:16,397, Anonymous Dropping the syslog as queue is full 100000
and which is why they are getting dropped.
2 suggestions:
check the filters > configure the filters for only those messages that you want
second :
plan to upgrade the LMS from 4.2.4 to 4.2.5 . LMS 4.2.5 have a fix of the syslogs issue . in 4.2.5 syslogs are well managed.
BUG:CSCul38962 : Syslog dropping issue
above BUG is fixed in 4.2.5
Thanks-
Afroz
***Ratings Encourages Contributors ****

Syslog issue in LMS 4.2

Hi I am facing weired issue with devcies syslogs. I can see syslog from only few devices though we have 160 devices.
can any one help me to get it running.
Thanks

First thing to look at is if the devices are configured properly to send syslogs to ciscoworks.
If yes, check Syslog.log (win) or syslog_info (sol/lin) to see if the missing devices syslog appears in that file. If the syslog is present in file, check filters if the filters are configured properly to forward the syslog to syslog DB else they might be dropped.
Attached image explains the Ciscoworks Syslog Architechture properly.
-Thanks
Vinod

EEM syslog issue

I have an issue with the syslog output of my eem script. The syslog command below does work. It sends an individual syslog message to my mgmt station for EACH line of cli output. I confirmed this with wireshark. The "show log" output looks fine (see below). I would like to get all the cli output or at least most of it in ONE large syslog message Anyone know how to fix this?
<script>
event manager applet SH_IP_NAT_STATS
event timer cron name nat_stats cron-entry "0-59/5 * * * *"
action 1.1 cli command "sh ip nat statistics"
action 1.2 syslog msg "cli: $_cli_result"
Log Buffer (52000 bytes):
000080: *Nov 15 04:30:00.052: %HA_EM-6-LOG: SH_IP_NAT_STATS: cli:
Total active translations: 38 (1 static, 37 dynamic; 38 extended)
Peak translations: 135, occurred 00:25:23 ago
Outside interfaces:
FastEthernet0/0, FastEthernet0/1
Inside interfaces:
Vlan10
Hits: 6270 Misses: 0
CEF Translated packets: 1078, CEF Punted packets: 5192
Expired translations: 622
Dynamic mappings:
-- Inside Source
[Id: 1] route-map nonat interface FastEthernet0/1 refcount 37
Appl doors: 5
Normal doors: 0
Queued Packets: 0

Ah, I misunderstood. There are a number of ways you could do this. One thing that might be easiest is to configure two applets:
event manager applet MARVEL
event syslog pattern "%MWR2900MRVL_FLTMG-5-EVENT_WARNING"
action 1.0 cli command "enable"
action 2.0 syslog msg "MWR2900MRVL: Marvell Chip Bug detected"
action 3.0 cli command "clear mac-address-table secure"
action 4.0 cli command "config t"
action 5.0 cli command "event manager applet MARVEL"
action 6.0 cli command "event none"
action 7.0 cli command "exit"
action 8.0 cli command "event manager applet MARVEL-countdown"
action 9.0 cli command "event timer countdown time 3600"
action 9.1 cli command "end"
event manager applet MARVEL-countdown
event none
action 1.0 cli command "enable"
action 2.0 cli command "config t"
action 3.0 cli command "event manager applet MARVEL-countdown"
action 4.0 cli command "event none"
action 5.0 cli command "event manager applet MARVEL"
action 6.0 cli command "event syslog pattern %MWR2900MRVL_FLTMG-5-EVENT_WARNING"
action 7.0 cli command "end"

CWCLI and XML issue on RME 4.3

Hi All,
     On a Windows 2008 Server with SP1 running LMS 3.2, I have a script that creates IOS configuration files with the appropriate XML command file for use with the cwcli config import function. The XML file contains the following tags and values:
<payload>
<command>
   cwcli config import -u admin -p [Base64PWD] -device [DisplayName]
<arg>
   -f
</arg>
<arg-val>
   D:\Program Files\CSCOpx\tftpboot\[DisplayName].cfg.[ID]
</arg-val>
</command>
</payload>
When I execute the sample script to invoke the Servelet, as provided in the RME users guide, I get the information that the job is running:

<cwcli> INFO - Devices to be attempted in the job:
[DisplayName]
<cwcli> INFO - The job 5548 is created
Waiting for the job results ...
<cwcli> - Job Status: Job Succeeded
Successful Devices:
[DisplayName]
<cwcli> INFO - CM0107 Import the config file to PRIMARY Running Config on device successful CM0091 Check if the device prompt is available.
CM0089 Config archival successful for [DisplayName]
<cwcli> INFO - The transport mode used is TFTP
SUMMARY
========
        Successful: import

After this is where it gets weird! On the switch - having previously issued the command "term mon" - I see the following output displayed:
Apr 28 16:56:38: %SYS-5-CONFIG_I: Configured from console by cw_2000_hq on vty2 (10.185.64.101)
Apr 28 16:56:46: %SYS-5-CONFIG_I: Configured from tftp://[CWServer]/20110428165646943-[DeviceIP].cfg by console
and checking the device I see that no changes have taken place. Inspection of the file that was sent via TFTP to the device indicates why - it contains garbage:
   D:\Program Files\CSCOpx\tftpboot\[DisplayName].cfg.[ID]
end
The file I am specifying between the XML <arg-val> tags contains these commands:
interface FastEthernet0/21
switchport access vlan 2400
switchport mode access
no cdp enable
spanning-tree portfast
ip verify source
shutdown
end
Can anyone tell me what I am doing wrong, please..?
Thanks,
SRGi

The documentation is wrong. Your payload should include the commands you want to deploy. So, use:
   cwcli config import -u admin -p [Base64PWD] -device [DisplayName]
   -f
interface FastEthernet0/21
switchport access vlan 2400
switchport mode access
no cdp enable
spanning-tree portfast
ip verify source
shutdown
end

Any one having noise issue running RME Fireface UFX with Logic Pro X on OS X 10.9.1?

I can't seem to get a consistent and reliable no-noise recording. I'm running OS X 10.9.1. My Fireface UFX is updated to firmware v353 and drivers are 1.91. I'm recording into Logic Pro X. I can occasionally get a good recording but eventually all I get is noise. Once the system is in this state I can sometimes reset the core audio by disabling and enabling core audio in Logic preferences. Not sure what the issue is. I called RME state-side tech support. They suggested it was some kind of USB bus issue. So I removed everthing on the bus except for the Fireface UFX. Still no luck. I have a brand new iMac (i7 with 16GB ram non-fusion drive) and a brand new Fireface UFX. Any help would be much appreciated.

" What you're seeing via USB is power management interruptions as the Haswell chipset and Mac OS is adjusting the USB bus to cut power usage."
Sounds fair enough . I'm no so sure it is linked to Fusion drive per se.
As wrote before, I have used Fusion for year without any glitch.
But it all remains a mystery. It's not my job to fix this.
Let's hope it won't take too long before they issue 10.9.2...
I French we say : "Les convoyeurs attendent" , it's also a song

Syslog issue in ACE

I worked the ace on last night
I configured two context, 128 and 130
There are no problem in load-balancing server farm
but there are some issue in logging-server
I configured the logging buffer 6 to send the system message to syslog server
I didn't configured the resource-class related syslog buffer in admin context it's default unlimit
In the this morning.
I logged in the syslog server and saw the log to check syslog message from ace.
but there are no syslog message in my syslog server. In my think, the ace doesn't send syslog to syslog server. so I cleared log message in system buffer, and I received the log message from ace.
What happen in ACE? It it a possible bug? or Am I missed configured ?
Anyone who tell me why this situation happen?
Why I could receive the log after clear the log in ace?
I have to clear the log buffer to receive the syslog from ace?
the configuration like below
logging enable
logging standby
logging console 3
logging timestamp
logging trap 6
logging buffered 6
logging host 192.168.100.1 udp/514
the system image is "c6ace-t1k9-mz.3.0.0_A1_6_2a.bin"

that's weird, but it might be because the syslog resource being all used already, it couldn't be allocated to your new context and the syslog process failed to start.
Once you cleared the buffer in Admin, you freed the syslog resources and the context could activate the syslog process.
We do recommend to set a max-limit to the syslog buffer to avoid consuming all the resources to allow creation of new contexts.
Gilles.

Syslog issue

I have syslog schedule job that runs every morning at 7am. every Monday
it runs empty until I restart the daemon, it's been doing it for several week. Today I have't restarted the daemon and started poking around, I went in and ran log roation since the syslog_info was large but that didn't help. Any other suggestion ?

What version of LMS are you running? Go to Common Services ---> Software Center --> Software Update and post the screenshot of version.
How large is the syslog.log file?
Post the SyslogCollector.log and SyslogAnalyzerUI.log file.
And if you don't care for the syslog.log file, you can stop the CiscoWorks Daemon and delete the syslog.log and restart the daemon manager so it can automatically create a new one.

RME 4.3.1 on new server - 2 issues with Inventory and syslog

Hi,
I recently installed new server 2003 with LMS3.2 and after the problems with DevicePackages i resubmitted all device and the device center tasks that was missing now reappeared.
So I went on and added my two VPN3030 VPN Concentrators.
This device is supported for RME inventory and syslog
I got the config-archive running (!) so thats fine (Runs via HTTPS login)
I have two issues:
1. I can not get inventory to work .
I have communication going, and a packet trace/sniff show I have syslog going into RME and i see SNMP GET and respones to/from device
I see some java error logs in ic_server.log fil
I have tried with two different LMS32-servers
I have increased SNMP timeout etc
I tried deleted the device and rediscover
log are like this:
[ Thu Aug 19 10:12:30 CEST 2010 ],ERROR,[Thread-14],com.cisco.nm.rmeng.inventory.ics.core.CollectionController,761, Collection failed for the device : 3748
com.cisco.nm.xms.xdi.ags.system.CollectionFailed: com.cisco.nm.lib.snmp.lib.SnmpException: SnmpResponseNoSuchName on 10.3.6.2 while performing SnmpWalk(*) at index = 10
    at com.cisco.nm.xms.xdi.pkgs.LibInventory.PortInterfaceAGI_RFC1213_HelperMethods.getIfTableEntriesFromDevice(PortInterfaceAGI_RFC1213_HelperMethods.java:639)
    at com.cisco.nm.xms.xdi.pkgs.SharedInventoryVPN3000.PortInterfaceAGI_RFC1213_Mib.g$eval(PortInterfaceAGI_RFC1213_Mib.java:77)
    at com.cisco.nm.xms.xdi.ags.PortInterfaceAGI.g$eval(PortInterfaceAGI.java:21)
    at com.cisco.nm.xms.xdi.SdiEngine.initAndEvalAGIs(SdiEngine.java:383)
    at com.cisco.nm.xms.xdi.SdiEngine.request(SdiEngine.java:309)
    at com.cisco.nm.xms.xdi.SdiEngine.getDevRepr(SdiEngine.java:302)
    at com.cisco.nm.rmeng.inventory.ics.core.CollectionController.run(CollectionController.java:539)
    at java.lang.Thread.run(Thread.java:595)
[ Thu Aug 19 10:12:30 CEST 2010 ],INFO ,[Thread-14],com.cisco.nm.rmeng.inventory.ics.core.CollectionController,841,Device collection failed for 10.3.6.2
2.:I can not get syslog into the devices syslog reports
This is wierder than issue 1: I have two VPN3030, one actually does syslog fine, but one VPN 3030 does not
I havent done any thing different for the two device ...
one simply works, one doesnt ...
I get no syslog msg in device center for one of the device.
The syslogs ARE infact in the syslog.log
The syslog msg DO show up, but in Unexpected device report ...
The same VPN device does work with my second server so I think this is related to RME database on one specific server.
But i have tried delete device and rediscover etc ...
please help ...

ok - looks like i need TAC again ...
As for the syslog issue - this happens only for one device on one of my servers ...
That is what is strange ... So IP is coorect and ok - (they do get syslogs into DevCenter on one server and on other device)
Thank you for your reply - really nice that you take your time into this forum !

RME cannot generate a syslog report.

Hi,
I have an issue with rme 4.2 from LMS 3.1
When I try to generate a syslog report this shows me nothing. I locate SyslogCollector.log file and I see sometnig wrong.
SyslogCollector - [Thread: Thread-9] WARN , 28 Apr 2011 14:45:10,400, Unable to add monitor for cwkstmm2009
SyslogCollector - [Thread: main] INFO , 09 May 2011 16:12:35,510, Logging System Initialized.
SyslogCollector - [Thread: main] INFO , 09 May 2011 16:12:35,519, System Initialized.
SyslogCollector - [Thread: main] WARN , 09 May 2011 16:12:40,948, Unable to resurrect connection to a subscriber.
SyslogCollector - [Thread: main] INFO , 09 May 2011 16:12:41,027, Service started...
SyslogCollector - [Thread: Thread-10] WARN , 09 May 2011 16:12:44,024, Unable to add monitor for cwkstmm2009
SyslogCollector - [Thread: main] INFO , 17 May 2011 11:08:17,360, Logging System Initialized.
SyslogCollector - [Thread: main] INFO , 17 May 2011 11:08:17,364, System Initialized.
SyslogCollector - [Thread: main] WARN , 17 May 2011 11:08:23,433, Unable to get the filters for subscriber cwkstmm2009. Default value will be used.
I modified Syslog.properties file to see DEBUG and this it the output
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,152, SCCleaner - About to fire close() on collector engine...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,153, SyslogCollectorEngine - Closing evaluators...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,153, FcssEvaluator - Closing LogReader...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,153, FcssEvaluator - Closing EmblemProcessor...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,154, FcssEvaluator - Releasing SyslogQueue...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,164, FcssEvaluator - Closed successfully...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,165, SyslogCollectorEngine - Closing filters...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,165, FcssFilter - Closing FilterProcessor Threads...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,165, FcssFilter - Closing Filter Store...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,166, FcssFilter - Closed successfully...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,166, SyslogCollectorEngine - Closing forwarders...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,166, FcssForwarder - Closing Forwarders...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,166, FcssForwarder - Releasing resources...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,167, FcssForwarder - Closed successfully.
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,167, SyslogCollectorEngine - Closing monitor...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,167, SyslogCollectorEngine - Closing monitor task...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,168, SyslogCollectorEngine - Closing recovery assistant...
SyslogCollector - [Thread: Thread-3] DEBUG, 17 May 2011 11:41:54,168, SyslogCollectorEngine - Closed successfully.
SyslogCollector - [Thread: main] INFO , 17 May 2011 11:42:05,837, Logging System Initialized.
SyslogCollector - [Thread: main] INFO , 17 May 2011 11:42:05,840, System Initialized.
SyslogCollector - [Thread: main] INFO , 17 May 2011 11:42:06,275, Subscriber list is empty!
SyslogCollector - [Thread: main] INFO , 17 May 2011 11:42:10,863, Service started...
I post the Syslog Collector Status image where it shows NOT REACHABLE.
Can you help me, please.

Hi,
I have tha same problem while subscribing. it gives me the error "could not subscribe to the collector"
Actually I want to generate Syslog and SNMP traps with Cisco lms 3.0
please help me about the error and am i configuring the right thing for my goal ? !!!!!
Rizwan Haider Siddiqui.......
[email protected]
+92-33-44-2222-39

How reports are generated for inventory/syslog in RME

Hi,
When we generate inventory/ syslog reports in RME, how these reports are generated, I mean what is the name of the database storing these reports.
We are running scheduled jobs that when logs reach certain size then they get purged and sometime we manually purged the logs as sometime automatic log purging do not work. Manually log rotation are saved in different drive not in CiscoWorks root directory i.e. E drive: and CiscoWorks root directory is C drive: In this case when we generate syslog/inventory reports from RME then how we can get the correct reports.
Please advise that what the correct procedure to generate accurate reports is.
I am using LMS 3.2.1;RME4.3.1
Thanks

We solved this by changing the parameter SAPLOCALHOSTFULL in ECC6 with the value sapecc.domain.com.au as per note 773830. Now the URL begins with this value for the RRI and therefore the logon tickets work.

RME 4.2 FWSM Archive Config

We have noticed that on RME when collectoing Configs from FWSM devies that it opens 3 SSH connections to the FWSM.
After successful collection it closes 1 but leaves the other 2 connections open for an hour.
Why does it do 3 and why does it not terminate the other 2?
Many Thanks
Carl

There have been numerous issues with RME and stale TCP sockets. I highly recommend you upgrade to LMS 3.2 SP1 to get all of the known bug fixes. This is a free upgrade for you.
As for the number of TCP sockets, one is used to test for SSH and version (this is only a connection to tcp/22 and not an SSH session). The second connection is for retrieving the config. The third session is likely for context modules. In this case, you're likely seeing CSCsy22242, which is fixed in LMS 3.2.

Syslog alerts and levels setting

Hi All,
I have 20 PIX and ASA firewall have been configured in my ciscoworks (lms 2.6)
I am able to get alerts like device down and authentication failure messages through mail, I guess these are from DFM.
My present concerns....
Configure syslogs in firewalls as per level 1-7 (ignore 7-5 in Ciscoworks) is that possible? If I configure syslog level as 1 then it is sending all syslogs from 1-7 which i dont want.
And I need to get syslog alerts from firewals to my ciscoworks and then from ciscoworks to my mailbox through email.
Can someone help me on this.
Thanks in advance.
Regards,
Jopeti.

You can use automated actions and syslog filters to achieve this based on the message type.
Resource Manager Essentials > Tools > Syslog > Automated Actions
http://www.cisco.com/en/US/partner/docs/net_mgmt/ciscoworks_resource_manager_essentials/4.0/user/guide/syslog.html#wp1211314
RME > Tools > Syslog > Message Filter
http://www.cisco.com/en/US/partner/docs/net_mgmt/ciscoworks_resource_manager_essentials/4.0/user/guide/syslog.html#wp1150419

How to Add FWSM 2.2 to Cisco Works VMS Inventory & syslog server

i've two FWSM & Cisco VMS 2.2 i want to configure them to send syslog messages to the syslog analyzer under RME 3.5, they are added to firewall MC 1.3, they send syslog messages to unexpected syslog devices under the syslog analyzer.

Checek if you have more than 5 Locale installed in the Unity connection :
http://cisco.com/en/US/docs/voice_ip_comm/connection/2x/os_administration/guide/2xcucosag070.html#wp1043540

Interface help please

Hello,
Am logic 7.1- PM g5 user.
Earlier I got some good advice from Rohan (on this group) and have narrowed my choice of an audio interface down to RME fireface or Metro Halo. He also ofilled in another I had about recording from them. So, now just to choose one device in particular. I am using m-audio now -1814 and have no compatibility issues. WOuld like to keep that but want to upgrade the unit primarily for better converters.
So, please any suggestions based on knowledge or experience will help greatly.
Best,
Doug

MH stuff is really good, if you need alot of gain from a 2882 it will get noisy. I have little problems on recordings with high SPLs (like drum kits)-converters, support and drivers are all great. No complaints. ULN2 is the same conversion with great pres. Can't go wrong with either unit, IMO. I love their portability and sound. Think of them as a RME/Motu traveler. If mobility is no issue then RME would typically be the better choice.

Syslog Issue in RME

Similar Messages

Maybe you are looking for