Syslog - log parsing

Hello,I have started using new syslog feature on my PMS 11.31. Do You have any expirience with parsig logs for SIEM? I am using IBM Qradar and it looks like I will have to parse information collected from Fsecure logs manualy. Do You have any xml file prepared which could help me with that?
Qradar DSM for F-secure would be ideal.

Hi there,
The Connector behavior is documented in detail in the Connector manual,
I believe. My understanding is that the Connector tries to identify
"new" event sources based on the *content* of inbound messages - so in
your example above, it would detect a new source labeled 192.168.30.40.
In this case it actually doesn't matter if the data was actually being
sent from some other IP address - the Connector cares about the IP
address in the syslog header. If, however, the message was sent from IP
A and no syslog header was present at all (e.g. the message started with
"A new user..."), then per the RFC the Syslog Connector would inject the
syslog header and identify a new source with IP A.
So one possibility is that the second time you tried this, you sent
data from a different IP address. Also, the Connector doesn't correlate
IPs/hostnames, so if you sent data with the hostname in the header
instead of the IP, that would also be seen as a new source.
I'd check these basics first, and if that still doesn't resolve the
issue we'll dig deeper.
DCorlette
DCorlette's Profile: http://forums.novell.com/member.php?userid=4437
View this thread: http://forums.novell.com/showthread.php?t=446501

Similar Messages

Socket error on syslog.log

- machine : HP-rx
- CPU : Itanium
- TimesTen 6.0.8
After OS reboot, below error was in the syslog.log.
Jun 20 20:51:20 hbepa TimesTen Data Manager 6.0.4.tt60[3000]: 3000: Error -232 reading line from socket 11
Jun 20 20:51:21 hbepa TimesTen Data Manager 6.0.4.tt60[2997]: 2997: Error -232 reading line from socket 10
- TimesTen log
20:54:30 Warn: 4668: : Ignoring '/var/TimesTen/tt60/DBI45159fee.0~'
20:54:30 Warn: 4668: : TimesTen Daemon Release 6.0.4.tt60 started.
20:55:28 Warn: 4668: : 3003 exited while connected to data store '/data/DataStore/hss2/hss2' shm 34480620 count=1
20:55:28 Warn: 4668: : 2998 exited while connected to data store '/data/DataStore/hss2/hss2' shm 34480620 count=1
21:05:48 Warn: 4668: : 4669/60000000000493e0: Recovery started
22:24:24 Warn: 4668: : 6480 exited while connected to data store '/data/DataStore/hss2/hss2' shm 101589484 count=1
23:13:31 Warn: 4668: : 7259 exited while connected to data store '/data/DataStore/hss2/hss2' shm 101589484 count=1
I am not sure whether it has a relation with this error, but replication was not working properly after this.
Will it have a relation? If it does what is suppose to be done after this issue occur.

Hi,
You say you are using TimesTen 6.0.8 but the log messages say 6.0.4? Could you clarify this please.
In order to make sense of the log we really need to see all the messages covering the relevant period, not just a selection.
While these messages are indicative of various things that are not 'normal' none of them on their own would explain why replication would not be working.
Chris

Cisco Security manager syslog.log file problem

Hello
I have this problem with the CSM, the next file Syslog.log (C:\Program Files\CSCOpx\log\Syslog.log ), this file grows very fast to fill the hard disk and saturates the server, I have tried the log rotation of the cisco works but it doesnt work, what else can i do?
the hard drive fills in 4 hours. tankyou

In CSM clinet under Tools > CSM Administration > Debugging you can changing the level to something higher than debugging.
I hope it helps.
PK

Syslog Reports not collect Syslog.log file Messages

I am doing a installation on CiscoWorks 3.2. after two three weeks I found my syslog services is not working properly. Once I checked on the syslog.log its updated with the device logs as normal. But when I am going to generate report it’s not collect data from the syslog log file. I have notice my syslog analyzer and syslog collator processes are shown as = Program started - No mgt msgs received. Is this normal on the LMS serve?
Anyway I found following error massagers on the SyslogAnalyzer.log file.
cisco.nm.xms.ctm.common.CTMException: CTMRegistryClient::addNewURNEntry URN : SyslogAnalyzerService ErrMsg : URN already in use
                at com.cisco.nm.xms.ctm.server.CTMServer.publish(CTMServer.java:253)
                at com.cisco.nm.xms.ctm.server.CTMServer.publish(CTMServer.java:180)
                at com.cisco.nm.rmeng.sa.SyslogAnalyzerEngine.registerWithCtm(SyslogAnalyzerEngine.java:2267)
                at com.cisco.nm.rmeng.sa.SyslogAnalyzerEngine.start(SyslogAnalyzerEngine.java:2189)
                at com.cisco.nm.rmeng.sa.SyslogAnalyzerService.main(SyslogAnalyzerService.java:109)
please I need your expertise knowledge to sort out this problem.
Thank you,
Chandimal.k
+94777420771

Hi,
Errors Found:
SyslogCollector - [Thread: main] WARN , 15 Dec 2011 14:33:46,505, Unable to resurrect connection to a subscriber.
URN : SyslogAnalyzerService ErrMsg : URN already in use
Try deleting the ctmregistry and ctmregistry.backup files and regenerat your SSL certificate and then resubscribed to the syslog collector.
1. net stop crmdmgtd
2. delete all the server.* files in ../CSCOpx/MDC/Apache/conf/SSL
3. Open a dos shell and cd to:
../CSCOpx/MDC/Apache, and run: perl ConfigSSL.pl -disable and then again perl ConfigSSL.pl -enable
You will see now a lot of questions, please make sure that you enter correctly the question of FQDN!
4. if you don't want to use SSL, run again: perl ConfigSSL.pl -disable
If you use SSL please don't do anything.
5. net start crmdmgtd
Then wait fifteen minutes for all the LMS services to come up before testing.
Thanks

Ciscoworks 3.1 syslog.log filtering

Hello Cisco community!
I would like to ask a question about syslog.log file in Ciscoworks 3.1.
I was able to forward my syslog messages to another syslog server ( with a syslog-agent forwarding the content of the syslog.log file ), but in the syslog.log file there is other syslog messages that i don't want to forward ( about processes and other things ). I only want to forward the syslog messages that the devices's sent to CW.
Can i somehow filter out in Ciscoworks the messages that i don't want to forward?
Thanks for help.

You mean you can't find the syslog.log file? A trip to regedit may be in order:
http://www.cisco.com/en/US/products/sw/cscowork/ps2073/products_tech_note09186a00800a7275.shtml
On a Windows System, the location is defined in the registry [ which can be viewed from regedit]:
\system\currentControlSet\Services\CRMlog\Parameters
LogFile = "CSCOpx\log\syslog.log"

Query for log Parser to get number of hits in a day or week for particular web applications or site collection

Hi All,
Want to get the number of hits in a day for a web application with IIS logs. so need to know Query for log Parser to get number hits in a day or week for particular web applications or site collection. Kindly help
Regards,
Naveen

I'm trying to get this from WSS 3.0, Hence using the Log Parser

CiscoWorks LMS 4.1, syslog analyzer parsing non-Cisco device.

Hello.
Can Syslog Analyzer parse syslog messages coming from a Non-Cisco device?
I'm trying to parse message from a HP Virtual Connect module without success.
Thanks.
Andrea

Hi Andrea,
You could use syslog-ng to write a generic mnemonic into the message and forward it to LMS.
Something like:
syslog-ng->add fac-sev-mne: message->lms
However, I would also caution you that LMS is *not* meant to be a "syslog" manager - there are usually way to many syslog messages in most environments for it to handle that many - which is why most syslog managers are standalone servers.
In order to make sure that the NMS systems that syslog-ng forward messages to receive the correct source, syslog-ng needs to be compiled with the source spoof option. This will allow messages received on other NMS’s (such as LMS) to appear to come from the original devices rather than from the syslog-ng server.
Compiling from source:
Install the syslog-ng prerequisites from Balabit
You must configure syslog-ng with --enable-spoof-source in order to enable the spoof source feature (which is disabled by default).
./configure --enable-spoof-source
make && make install
If you run into any issues during the installation, you can refer to the syslog-ng forum or you can refer to the syslog-ng knowledge base
Lastly, here's a great paper on syslog management:
Building Scalable Syslog Management Solutions

Syslog Log Rotation

Dear,
Just to understand syslog log rotation. I have configured syslog_info file for log rotation and size i have give is 100mb with 0 no of backups. I have scheduled it to run every week with a backup path. Basically i dont want any backups and i want the syslog_info to be overwritten when it reaches 100mb, are my setting correct?
thanks,
aamir

yes that is right,
you can see it also explained in the logrot document
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_common_services_software/3.1.1/user/guide/admin.html#wp645704
Step 5 Specify the number of archive revisions. If you do not want to keep any archives, enter 0 (the default) for this option.
hope this is what you are looking for.

Log parser query

Hi, I need assistance in writing a log parser query which can read input from a txt file which contains smtp addresses. The query should search for each of the smtp addresses in the input file against a log file. The query results need to be exported to
a csv file.
Thanks,
Feroz
Feroz

Hi,
You need to ask about Log Parser in the Log Parser forum rather than here.
http://forums.iis.net/default.aspx/51
Bill

RSA ACE server SYSLOG collector, Parsing help!

Hi Board.
I am in a very big hurry for developing a RSA ACE collector script. The
already released RSA ACE Collector script is file based and the RSA ACE
server can dump a CSV log report with an interval of a hour as the
fastest possible interval. This is not at all satisfying for the
customer which - due to the latest issue with hacking attacks on EMC's
network both announced in the press and by letter from EMC and to their
customers - is not at all acceptable. They need to have logic for
pattern searches and correlation rules that can respond as close to real
time as possible.
We have with success and without any troubles or big efforts installed
the SNARE agent on the RSA ACE Appliance box. We are receiving the
events from the RSA server correctly (or we are receiving the events as
unsupported events because the events is not parsed correctly, but all
the needed information is there) and I have started development of a new
Collector script based on the Generic Event Collector (Just
doubleclicked on New Collector script in the Ant menu).
So far I have tryed some different approaches. I know that I can totaly
manipulate with the events received from the Source because I can
pre-set values via the protoEvt.map file. Even further have I been able
to set some other values in the Parse function by using the rec2Evt.map
and then hardcode a value to the desired field by using
rec.-input_record_field-.
Therefor I am pretty convinced that I am on the right track.
Now here is my question:
Based on this copy-pasted s_RXBufferString value (IP addresses and
host+domain values changed for protecting the customer):
Code:
Mar 26 05:48:12 192.168.1.100 hostname[tab]MSWinEventLog[tab]4[tab]Application[tab]14765[tab]Sat Mar 26 10:48:12 2011[tab]1011[tab]ACESERVER6.1[tab]Unknown User[tab]N/A[tab]Information[tab]hostname[tab]Devices[tab][tab][tab]Passcode accepted (Login:'jodo'; User Name:'Doe, John'; Token:'000123456789'; Group:''; Site:''; Agent Host:'remotehost.domain.com'; Server:'serverhost').[tab]14617
*NB!* Swap out [tab] with tablulator delimiter!
I have tryed this approach (this is the entire Parse Functiomn):
Code:
var ValueArray = this.s_RXBufferString.split("\\t");
rec.msg = this.s_RXBufferString;
var SourceInfo = ValueArray[0];
rec.sun = ValueArray[1];
//e.InitServiceName = ValueArray[1];
//rec.Service = ValueArray[1];
//e.EventTime = ValueArray[5];
//rec.EvtTime = ValueArray[5];
//e.VendorEventCode = ValueArray[6];
rec.evtCode = ValueArray[6];
e.DeviceName = ValueArray[7];
rec.sun = ValueArray[8];
//e.EffectiveUserID = ValueArray[8];
//var OSInitUser = ValueArray[8];
//e.InitHostName = ValueArray[11];
rec.shd = ValueArray[11];
//ValueArray[12] = ValueArray[12].ltrim();
var AppSpecificMessage = '';
for(var t = 12; t<count(ValueArray); t+1)
AppSpecificMessage += ValueArray[t];
//e.InitIP = SourceInfo.match("[0-9]+.[0-9]+.[0-9].[0-9]");
rec.sip = this.s_RXBufferString.match("\d+\.\d+\.\d+\.\d+");
var A = AppSpecificMessage.search('\(.+\)');
//e.EventName = 'Debugging RSA';
//e.EventName = AppSpecificMessage.substring(0,A-1).ltrim();
rec.evt = AppSpecificMessage.substring(0,A-1).ltrim();
AppSpecificMessage = AppSpecificMessage.match('\(.+\)');
// var B = AppSpecificMessage.search(')');
//var B = AppSpecificMessage.search(')');
// var BaseInfo = AppSpecificMessage.substring(A+1,B-1);
// var BaseTmpArray = BaseInfo.split(';');
// var BaseArray = new Array();
/*for(var i = 0; i<count(BaseTmpArray); i+1)
var str = BaseTmpArray[i].ltrim();
var TempAr = str.split(':');
BaseArray.push(TempAr[1].substring(1,-1));
/*var AgentArr = BaseArray[6].split(".");
AgentArr.reverse();
AgentArr.pop();
AgentArr.reverse();
e.InitHostDomain = AgentArr.join(".");
//rec.InitDomain = AgentArr.join(".");
e.InitHostDomain = "corp.ad.local";
if (ValueArray[10] == "Information")
rec.sev = "0";
//e.Severity = "0";
else if (ValueArray[10] == "Warning")
rec.sev = "3";
//e.Severity = "3";
else if (ValueArray[10] == "Error")
rec.sev = "4"
//e.Severity = "4";
else
rec.sev = "1";
//e.Severity = "1";
//e.InitUserID = BaseArray[0];
rec.LoginName = BaseArray[0];
//e.InitUserName = BaseArray[1];
rec.UserName = BaseArray[1];
//e.customerVar35 = BaseArray[2];
//rec.Token = BaseArray[2];
//e.customerVar36 = BaseArray[5];
//rec.Agent = BaseArray[5];
instance.SEND_EVENT = true;
// parsing logic goes here
/*if (1==1) { // set SEND_EVENT to true if your parsing logic worked correctly
instance.SEND_EVENT = true;
// If you can't parse...
//rec.sendUnsupported();
return true;
But it just laughs at me and wont work. It states that there is a
parsing error: match function something with input.
Can you please help me build a logic that will work as intended? It
should be clear what information or which piece of the text that I try
map to which Event fields (look at the outcommented bits right above or
below the ones that point to a rec.something because there I have tryed
just map the information directly).
kkrasmussen
kkrasmussen's Profile: http://forums.novell.com/member.php?userid=20966
View this thread: http://forums.novell.com/showthread.php?t=435715

> - I'm not sure I understand why you replace the tabs with '|' just to do
> the split; why can't you just split on tab? You can also investigate our
> 'safesplit()' method, which understands quoted delimited strings:
> Novell Login
> (not sure that's necessary in this case)
I replaced the tabs with '|' foir easier regex searchess for both
numbers, alphanummeric and spaces in same match cases - but with the
opportunity to index better for those searches because I did not need to
worry about the tabs being recognised as whitespaces anymore.
The safesplit works fine with '|' but not for this one:
Code:
var AppSpecificArray = AppSpecificMessage.safesplit(";");
It reports that: "Cannot find function safesplit".
If I change that to:
Code:
var AppSpecificArray = AppSpecificMessage.split(/\;/);
It reports that: "Cannot find function split".
> - The 'substring()' method is defined as taking two arguments:
> from Required. The index where to start the extraction. First character
> is at index 0
> to Optional. The index where to stop the extraction. If omitted, it
> extracts the rest of the string
> Neither of those two arguments will *ever* be negative - they always
> count from the beginning of the string. What you're really trying to do
> is to extract the substring from the beginning +1 character, to the end
> -2 characters, which is not how substring() works. But you *can* do
> something like:
> this.evt = Msg.substring(1,Msg.length - 2);
>
Aha I see. Thanks for the info. However, I tried the suggested this.evt
= Msg.substring(1,Msg.length - 2); but it reports: Cannot call method
"substring" of null. Remember that I have already testet and verified
that I do have a value in the Msg variable.
Here is the newest code. Please notice that I have outcommented the
desired "result" and is just trying to get something from at least the
part of the string that I want to parse.
Code:
this.msg = this.s_raw_message2;
var TempTxt = this.s_raw_message2.replace(/\t/g,"|");
var ValueArray = TempTxt.safesplit("|");
var SourceInfo = ValueArray[0];
this.evtCode = ValueArray[6];
this.sip = TempTxt.match(/\d+\.\d+\.\d+\.\d+/);
e.DeviceName = ValueArray[7];
//AppSpecificMessage = TempTxt.match(/(?:\().+(?:\))/);
var Msg = ValueArray[14].match(/(?:\|)[^\|]+(?:\()/);
this.evt = Msg.substring(1,Msg.length - 2);
//this.evt = Msg;
AppSpecificMessage = ValueArray[14].match(/(?:\().+(?:\))/);
if (ValueArray[10] == "Information")
this.sev = "0";
else if (ValueArray[10] == "Warning")
this.sev = "3";
else if (ValueArray[10] == "Error")
this.sev = "4"
else
this.sev = "1";
if(TempTxt.match(/(?:Login:\')\S+(?:')/) != false)
//var apptemp = AppSpecificMessage.substring(1,AppSpecificMessage. length - 1);
//var AppSpecificArray = apptemp.safesplit(";");
var AppSpecificArray = AppSpecificMessage.safesplit(";");
for(var c = 0; c<count(AppSpecificArray); c + 1)
var key = AppSpecificArray[c].split(/:/);
if (key[0] == "(Login")
if (key[1] == "''")
this.iuid = ValueArray[8];
else
this.iuid = key[1];
//this.iuid = key[1].substring(1,key[1].length - 1);
if (key[0] == " User Name")
if (key[1] == "''")
this.sun = "System";
else
this.sun = key[1];
//this.sun = key[1].substring(1,key[1].length - 1);
if (key[0] == " Agent Host")
if (key[1] == "'')")
this.shd = "Unknown Host Domain";
else
//var TempArr = key[1].substring(1,key[1].length - 1).safesplit(".");
var TempArr = key[1].plit(/\./);
TempArr.reverse();
TempArr.pop();
TempArr.reverse();
this.shd = TempArr.join(".");
if (key[0] == " Token")
if (key[1] != "''")
e.CustomerVar35 = key[1];
//e.CustomerVar35 = key[1].substring(1,key[1].length - 1);
else
this.shd = "Unknown Host Domain";
this.iuid = ValueArray[8];
this.sun = "System";
instance.SEND_EVENT = true;
return true;
kkrasmussen
kkrasmussen's Profile: http://forums.novell.com/member.php?userid=20966
View this thread: http://forums.novell.com/showthread.php?t=435715

Syslog.log messages with regard to VpxaHalCnxHostagent

hi, i need a sharing of your precious knowledge.
After upgrading vmware server to 5.5 from 5.1, vmware keeps generating messages as follows.
Syslog daemon repeats similar pattern like followings.
what is the reason and in case of error what's the solution to prevent generating messages except changing logging level?
good day~
thx in advance.
==========================================================================================================================================================
<166>2015-01-15T01:27:03.773Z esx01 Vpxa: [FFF41B70 verbose 'VpxaHalCnxHostagent' opID=WFU-d4f96507] [WaitForUpdatesDone] Completed callback
<166>2015-01-15T01:27:04.034Z esx01 Vpxa: [FFF62B70 verbose 'VpxaHalCnxHostagent' opID=WFU-63ff9782] [WaitForUpdatesDone] Received callback
<166>2015-01-15T01:27:04.034Z esx01 Vpxa: [FFF62B70 verbose 'VpxaHalCnxHostagent' opID=WFU-63ff9782] [VpxaHalCnxHostagent::ProcessUpdate] Applying updates from 2329019 to 2329020 (at 2329019)
<166>2015-01-15T01:27:04.034Z esx01 Vpxa: [FFF62B70 verbose 'VpxaHalCnxHostagent' opID=WFU-63ff9782] [WaitForUpdatesDone] Starting next WaitForUpdates() call to hostd
<166>2015-01-15T01:27:04.034Z esx01 Vpxa: [FFF62B70 verbose 'VpxaHalCnxHostagent' opID=WFU-63ff9782] [WaitForUpdatesDone] Completed callback
<166>2015-01-15T01:27:04.103Z esx01 Hostd: [2AA40B70 verbose 'SoapAdapter'] Responded to service state request
<166>2015-01-15T01:27:05.357Z esx01 Vpxa: [FFA171A0 verbose 'VpxaHalCnxHostagent' opID=WFU-6e390e9d] [WaitForUpdatesDone] Received callback
<166>2015-01-15T01:27:05.357Z esx01 Vpxa: [FFA171A0 verbose 'VpxaHalCnxHostagent' opID=WFU-6e390e9d] [VpxaHalCnxHostagent::ProcessUpdate] Applying updates from 2329020 to 2329021 (at 2329020)
<166>2015-01-15T01:27:05.357Z esx01 Vpxa: [FFA171A0 verbose 'VpxaHalCnxHostagent' opID=WFU-6e390e9d] [WaitForUpdatesDone] Starting next WaitForUpdates() call to hostd
<166>2015-01-15T01:27:05.357Z esx01 Vpxa: [FFA171A0 verbose 'VpxaHalCnxHostagent' opID=WFU-6e390e9d] [WaitForUpdatesDone] Completed callback
<166>2015-01-15T01:27:07.204Z esx01 Vpxa: [FFF41B70 verbose 'VpxaHalCnxHostagent' opID=WFU-9847c2b9] [WaitForUpdatesDone] Received callback
<166>2015-01-15T01:27:07.205Z esx01 Vpxa: [FFF41B70 verbose 'VpxaHalCnxHostagent' opID=WFU-9847c2b9] [VpxaHalCnxHostagent::ProcessUpdate] Applying updates from 2329021 to 2329022 (at 2329021)
<166>2015-01-15T01:27:07.205Z esx01 Vpxa: [FFF41B70 verbose 'VpxaHalCnxHostagent' opID=WFU-9847c2b9] [WaitForUpdatesDone] Starting next WaitForUpdates() call to hostd
<166>2015-01-15T01:27:07.205Z esx01 Vpxa: [FFF41B70 verbose 'VpxaHalCnxHostagent' opID=WFU-9847c2b9] [WaitForUpdatesDone] Completed callback
<166>2015-01-15T01:27:08.625Z esx01 Vpxa: [FFA171A0 verbose 'VpxaHalCnxHostagent' opID=WFU-cbae553f] [WaitForUpdatesDone] Received callback
<166>2015-01-15T01:27:08.625Z esx01 Vpxa: [FFA171A0 verbose 'VpxaHalCnxHostagent' opID=WFU-cbae553f] [VpxaHalCnxHostagent::ProcessUpdate] Applying updates from 2329022 to 2329023 (at 2329022)
<166>2015-01-15T01:27:08.625Z esx01 Vpxa: [FFA171A0 verbose 'VpxaHalCnxHostagent' opID=WFU-cbae553f] [WaitForUpdatesDone] Starting next WaitForUpdates() call to hostd
<166>2015-01-15T01:27:08.625Z esx01 Vpxa: [FFA171A0 verbose 'VpxaHalCnxHostagent' opID=WFU-cbae553f] [WaitForUpdatesDone] Completed callback
<166>2015-01-15T01:27:09.524Z esx01 Vpxa: [FFA171A0 verbose 'VpxaHalCnxHostagent' opID=WFU-ea2ec0ef] [WaitForUpdatesDone] Received callback
<166>2015-01-15T01:27:09.524Z esx01 Vpxa: [FFA171A0 verbose 'VpxaHalCnxHostagent' opID=WFU-ea2ec0ef] [VpxaHalCnxHostagent::ProcessUpdate] Applying updates from 2329023 to 2329024 (at 2329023)
<166>2015-01-15T01:27:09.524Z esx01 Vpxa: [FFA171A0 verbose 'VpxaHalCnxHostagent' opID=WFU-ea2ec0ef] [WaitForUpdatesDone] Starting next WaitForUpdates() call to hostd
<166>2015-01-15T01:27:09.524Z esx01 Vpxa: [FFA171A0 verbose 'VpxaHalCnxHostagent' opID=WFU-ea2ec0ef] [WaitForUpdatesDone] Completed callback
<166>2015-01-15T01:27:12.344Z esx01 Vpxa: [FFF62B70 verbose 'hostdstats'] Set internal stats for VM: 4 (vpxa VM id), 186 (vpxd VM id). Is FT primary? false
<166>2015-01-15T01:27:12.347Z esx01 Vpxa: [FFF62B70 verbose 'hostdstats'] Set internal stats for VM: 10 (vpxa VM id), 1398 (vpxd VM id). Is FT primary? false
<166>2015-01-15T01:27:12.349Z esx01 Vpxa: [FFF62B70 verbose 'hostdstats'] Set internal stats for VM: 11 (vpxa VM id), 1444 (vpxd VM id). Is FT primary? false
<166>2015-01-15T01:27:12.351Z esx01 Vpxa: [FFF62B70 verbose 'hostdstats'] Set internal stats for VM: 13 (vpxa VM id), 1763 (vpxd VM id). Is FT primary? false
<166>2015-01-15T01:27:12.353Z esx01 Vpxa: [FFF62B70 verbose 'hostdstats'] Set internal stats for VM: 15 (vpxa VM id), 1766 (vpxd VM id). Is FT primary? false
<166>2015-01-15T01:27:12.356Z esx01 Vpxa: [FFF62B70 verbose 'hostdstats'] Set internal stats for VM: 16 (vpxa VM id), 1765 (vpxd VM id). Is FT primary? false
<166>2015-01-15T01:27:12.358Z esx01 Vpxa: [FFF62B70 verbose 'hostdstats'] Set internal stats for VM: 17 (vpxa VM id), 1767 (vpxd VM id). Is FT primary? false
<166>2015-01-15T01:27:12.360Z esx01 Vpxa: [FFF62B70 verbose 'hostdstats'] Set internal stats for VM: 20 (vpxa VM id), 2072 (vpxd VM id). Is FT primary? false
<166>2015-01-15T01:27:12.363Z esx01 Vpxa: [FFF62B70 verbose 'hostdstats'] Set internal stats for VM: 21 (vpxa VM id), 2073 (vpxd VM id). Is FT primary? false
<166>2015-01-15T01:27:12.365Z esx01 Vpxa: [FFF62B70 verbose 'hostdstats'] Set internal stats for VM: 22 (vpxa VM id), 2074 (vpxd VM id). Is FT primary? false
<166>2015-01-15T01:27:12.368Z esx01 Vpxa: [FFF62B70 verbose 'hostdstats'] Set internal stats for VM: 24 (vpxa VM id), 2076 (vpxd VM id). Is FT primary? false
<166>2015-01-15T01:27:12.370Z esx01 Vpxa: [FFF62B70 verbose 'hostdstats'] Set internal stats for VM: 27 (vpxa VM id), 3068 (vpxd VM id). Is FT primary? false
<166>2015-01-15T01:27:12.372Z esx01 Vpxa: [FFF62B70 verbose 'hostdstats'] Set internal stats for VM: 28 (vpxa VM id), 170 (vpxd VM id). Is FT primary? false
<166>2015-01-15T01:27:19.302Z esx01 Vpxa: [FFF41B70 verbose 'SoapAdapter'] Responded to service state request
<166>2015-01-15T01:27:19.303Z esx01 Vpxa: [FFF41B70 info 'commonvpxLro' opID=6cda81e2-78] [VpxLRO] -- BEGIN task-internal-15115227 -- -- vpxapi.VpxaService.queryAvailableMetric -- 5fded20a-0547-50ac-55b0-56916daa94da
<166>2015-01-15T01:27:19.305Z esx01 Hostd: [28E81B70 verbose 'Default' opID=6cda81e2-78 user=vpxuser] AdapterServer: target='vim.PerformanceManager:ha-perfmgr', method='queryAvailableMetric'
<166>2015-01-15T01:27:19.385Z esx01 Vpxa: [FFF62B70 verbose 'VpxaHalCnxHostagent' opID=WFU-5a2f27cb] [WaitForUpdatesDone] Received callback
<166>2015-01-15T01:27:19.385Z esx01 Vpxa: [FFF62B70 verbose 'VpxaHalCnxHostagent' opID=WFU-5a2f27cb] [VpxaHalCnxHostagent::ProcessUpdate] Applying updates from 2329024 to 2329025 (at 2329024)
<166>2015-01-15T01:27:19.385Z esx01 Vpxa: [FFF62B70 verbose 'VpxaHalCnxHostagent' opID=WFU-5a2f27cb] [WaitForUpdatesDone] Starting next WaitForUpdates() call to hostd
<166>2015-01-15T01:27:19.385Z esx01 Vpxa: [FFF62B70 verbose 'VpxaHalCnxHostagent' opID=WFU-5a2f27cb] [WaitForUpdatesDone] Completed callback
<166>2015-01-15T01:27:19.391Z esx01 Vpxa: [FFF41B70 verbose 'vpxavpxaVmomi' opID=6cda81e2-78] [VpxaVmomi] SetStatusDone was called with syncGenNo (62962)
<166>2015-01-15T01:27:19.391Z esx01 Vpxa: [FFF41B70 info 'commonvpxLro' opID=6cda81e2-78] [VpxLRO] -- FINISH task-internal-15115227 -- -- vpxapi.VpxaService.queryAvailableMetric --
<166>2015-01-15T01:27:19.464Z esx01 Vpxa: [FFF62B70 info 'commonvpxLro' opID=54a6e142-9b] [VpxLRO] -- BEGIN task-internal-15115228 -- -- vpxapi.VpxaService.queryBatchPerformanceStatistics -- 5fded20a-0547-50ac-55b0-56916daa94da
<166>2015-01-15T01:27:19.464Z esx01 Vpxa: [FFF62B70 verbose 'vpxavpxaMoService' opID=54a6e142-9b] Adding querySpec. Had=24, has=24
<166>2015-01-15T01:27:19.466Z esx01 Hostd: [29EC1B70 verbose 'Default' opID=54a6e142-9b user=vpxuser] AdapterServer: target='vim.PerformanceManager:ha-perfmgr', method='summarizeStats'
<166>2015-01-15T01:27:19.474Z esx01 Vpxa: [FFF62B70 verbose 'vpxavpxaVmomi' opID=54a6e142-9b] [VpxaVmomi] SetStatusDone was called with syncGenNo (62962)
<166>2015-01-15T01:27:19.474Z esx01 Vpxa: [FFF62B70 info 'commonvpxLro' opID=54a6e142-9b] [VpxLRO] -- FINISH task-internal-15115228 -- -- vpxapi.VpxaService.queryBatchPerformanceStatistics --
<166>2015-01-15T01:27:19.484Z esx01 Vpxa: [FFA171A0 info 'commonvpxLro' opID=146d66ec-c5] [VpxLRO] -- BEGIN task-internal-15115229 -- -- vpxapi.VpxaService.queryAvailableMetric -- 5fded20a-0547-50ac-55b0-56916daa94da
<166>2015-01-15T01:27:19.485Z esx01 Hostd: [28EC2B70 verbose 'Default' opID=146d66ec-c5 user=vpxuser] AdapterServer: target='vim.PerformanceManager:ha-perfmgr', method='queryAvailableMetric'
<166>2015-01-15T01:27:19.565Z esx01 Vpxa: [FFA171A0 verbose 'vpxavpxaVmomi' opID=146d66ec-c5] [VpxaVmomi] SetStatusDone was called with syncGenNo (62962)
<166>2015-01-15T01:27:19.565Z esx01 Vpxa: [FFA171A0 info 'commonvpxLro' opID=146d66ec-c5] [VpxLRO] -- FINISH task-internal-15115229 -- -- vpxapi.VpxaService.queryAvailableMetric --
<166>2015-01-15T01:27:19.640Z esx01 Vpxa: [FFF62B70 info 'commonvpxLro' opID=410069ff-c1] [VpxLRO] -- BEGIN task-internal-15115230 -- -- vpxapi.VpxaService.queryBatchPerformanceStatistics -- 5fded20a-0547-50ac-55b0-56916daa94da
<166>2015-01-15T01:27:19.640Z esx01 Vpxa: [FFF62B70 verbose 'vpxavpxaMoService' opID=410069ff-c1] Adding querySpec. Had=24, has=24
<166>2015-01-15T01:27:19.642Z esx01 Hostd: [2A540B70 verbose 'Default' opID=410069ff-c1 user=vpxuser] AdapterServer: target='vim.PerformanceManager:ha-perfmgr', method='summarizeStats'
<166>2015-01-15T01:27:19.652Z esx01 Vpxa: [FFF62B70 verbose 'vpxavpxaVmomi' opID=410069ff-c1] [VpxaVmomi] SetStatusDone was called with syncGenNo (62962)
<166>2015-01-15T01:27:19.652Z esx01 Vpxa: [FFF62B70 info 'commonvpxLro' opID=410069ff-c1] [VpxLRO] -- FINISH task-internal-15115230 -- -- vpxapi.VpxaService.queryBatchPerformanceStatistics --
<182>2015-01-15T01:27:20.034Z esx01 vmkernel: cpu48:34604)World: 14299: VC opID hostd-a352 maps to vmkernel opID 14f3e117
<166>2015-01-15T01:27:20.500Z esx01 Vpxa: [FFF41B70 info 'commonvpxLro' opID=6b3354bc-8d] [VpxLRO] -- BEGIN task-internal-15115231 -- -- vpxapi.VpxaService.queryAvailableMetric -- 5fded20a-0547-50ac-55b0-56916daa94da
<166>2015-01-15T01:27:20.502Z esx01 Hostd: [28EC2B70 verbose 'Default' opID=6b3354bc-8d user=vpxuser] AdapterServer: target='vim.PerformanceManager:ha-perfmgr', method='queryAvailableMetric'
<166>2015-01-15T01:27:20.583Z esx01 Vpxa: [FFF41B70 verbose 'vpxavpxaVmomi' opID=6b3354bc-8d] [VpxaVmomi] SetStatusDone was called with syncGenNo (62962)
<166>2015-01-15T01:27:20.584Z esx01 Vpxa: [FFF41B70 info 'commonvpxLro' opID=6b3354bc-8d] [VpxLRO] -- FINISH task-internal-15115231 -- -- vpxapi.VpxaService.queryAvailableMetric --
<166>2015-01-15T01:27:20.653Z esx01 Vpxa: [FFF62B70 info 'commonvpxLro' opID=3efe8560-5c] [VpxLRO] -- BEGIN task-internal-15115232 -- -- vpxapi.VpxaService.queryBatchPerformanceStatistics -- 5fded20a-0547-50ac-55b0-56916daa94da
<166>2015-01-15T01:27:20.653Z esx01 Vpxa: [FFF62B70 verbose 'vpxavpxaMoService' opID=3efe8560-5c] Adding querySpec. Had=24, has=24
<166>2015-01-15T01:27:20.656Z esx01 Hostd: [29EC1B70 verbose 'Default' opID=3efe8560-5c user=vpxuser] AdapterServer: target='vim.PerformanceManager:ha-perfmgr', method='summarizeStats'
<166>2015-01-15T01:27:20.663Z esx01 Vpxa: [FFF62B70 verbose 'vpxavpxaVmomi' opID=3efe8560-5c] [VpxaVmomi] SetStatusDone was called with syncGenNo (62962)
<166>2015-01-15T01:27:20.663Z esx01 Vpxa: [FFF62B70 info 'commonvpxLro' opID=3efe8560-5c] [VpxLRO] -- FINISH task-internal-15115232 -- -- vpxapi.VpxaService.queryBatchPerformanceStatistics --
<166>2015-01-15T01:27:20.673Z esx01 Vpxa: [FFF41B70 info 'commonvpxLro' opID=3cbb0029-12] [VpxLRO] -- BEGIN task-internal-15115233 -- -- vpxapi.VpxaService.queryAvailableMetric -- 5fded20a-0547-50ac-55b0-56916daa94da
<166>2015-01-15T01:27:20.674Z esx01 Hostd: [29EC1B70 verbose 'Default' opID=3cbb0029-12 user=vpxuser] AdapterServer: target='vim.PerformanceManager:ha-perfmgr', method='queryAvailableMetric'
<166>2015-01-15T01:27:20.754Z esx01 Vpxa: [FFF41B70 verbose 'vpxavpxaVmomi' opID=3cbb0029-12] [VpxaVmomi] SetStatusDone was called with syncGenNo (62962)
<166>2015-01-15T01:27:20.755Z esx01 Vpxa: [FFF41B70 info 'commonvpxLro' opID=3cbb0029-12] [VpxLRO] -- FINISH task-internal-15115233 -- -- vpxapi.VpxaService.queryAvailableMetric --
<182>2015-01-15T01:27:20.813Z esx01 vmkernel: cpu28:37308)World: 14299: VC opID 3cbb0029-12 maps to vmkernel opID 23cabaea
<166>2015-01-15T01:27:20.825Z esx01 Vpxa: [33482B70 info 'commonvpxLro' opID=3d879500-e8] [VpxLRO] -- BEGIN task-internal-15115234 -- -- vpxapi.VpxaService.queryBatchPerformanceStatistics -- 5fded20a-0547-50ac-55b0-56916daa94da
<166>2015-01-15T01:27:20.826Z esx01 Vpxa: [33482B70 verbose 'vpxavpxaMoService' opID=3d879500-e8] Adding querySpec. Had=24, has=24
<166>2015-01-15T01:27:20.827Z esx01 Hostd: [2A540B70 verbose 'Default' opID=3d879500-e8 user=vpxuser] AdapterServer: target='vim.PerformanceManager:ha-perfmgr', method='summarizeStats'
<166>2015-01-15T01:27:20.833Z esx01 Vpxa: [33482B70 verbose 'vpxavpxaVmomi' opID=3d879500-e8] [VpxaVmomi] SetStatusDone was called with syncGenNo (62962)
<166>2015-01-15T01:27:20.833Z esx01 Vpxa: [33482B70 info 'commonvpxLro' opID=3d879500-e8] [VpxLRO] -- FINISH task-internal-15115234 -- -- vpxapi.VpxaService.queryBatchPerformanceStatistics --
<166>2015-01-15T01:27:20.948Z esx01 Vpxa: [33482B70 info 'commonvpxLro' opID=2334f0b5-41] [VpxLRO] -- BEGIN task-internal-15115235 -- -- vpxapi.VpxaService.queryAvailableMetric -- 5fded20a-0547-50ac-55b0-56916daa94da
<166>2015-01-15T01:27:20.949Z esx01 Hostd: [2AA40B70 verbose 'Default' opID=2334f0b5-41 user=vpxuser] AdapterServer: target='vim.PerformanceManager:ha-perfmgr', method='queryAvailableMetric'
<166>2015-01-15T01:27:21.027Z esx01 Vpxa: [33482B70 verbose 'vpxavpxaVmomi' opID=2334f0b5-41] [VpxaVmomi] SetStatusDone was called with syncGenNo (62962)
<166>2015-01-15T01:27:21.028Z esx01 Vpxa: [33482B70 info 'commonvpxLro' opID=2334f0b5-41] [VpxLRO] -- FINISH task-internal-15115235 -- -- vpxapi.VpxaService.queryAvailableMetric --
<166>2015-01-15T01:27:21.101Z esx01 Vpxa: [33482B70 info 'commonvpxLro' opID=416c2f9-d7] [VpxLRO] -- BEGIN task-internal-15115236 -- -- vpxapi.VpxaService.queryBatchPerformanceStatistics -- 5fded20a-0547-50ac-55b0-56916daa94da
<166>2015-01-15T01:27:21.101Z esx01 Vpxa: [33482B70 verbose 'vpxavpxaMoService' opID=416c2f9-d7] Adding querySpec. Had=28, has=28
<166>2015-01-15T01:27:21.103Z esx01 Hostd: [FFCD5920 verbose 'Default' opID=416c2f9-d7 user=vpxuser] AdapterServer: target='vim.PerformanceManager:ha-perfmgr', method='summarizeStats'
<166>2015-01-15T01:27:21.112Z esx01 Vpxa: [33482B70 verbose 'vpxavpxaVmomi' opID=416c2f9-d7] [VpxaVmomi] SetStatusDone was called with syncGenNo (62962)
<166>2015-01-15T01:27:21.112Z esx01 Vpxa: [33482B70 info 'commonvpxLro' opID=416c2f9-d7] [VpxLRO] -- FINISH task-internal-15115236 -- -- vpxapi.VpxaService.queryBatchPerformanceStatistics --
<166>2015-01-15T01:27:21.123Z esx01 Vpxa: [FFA171A0 info 'commonvpxLro' opID=2ccc1c6-bc] [VpxLRO] -- BEGIN task-internal-15115237 -- -- vpxapi.VpxaService.queryAvailableMetric -- 5fded20a-0547-50ac-55b0-56916daa94da
<166>2015-01-15T01:27:21.124Z esx01 Hostd: [28EC2B70 verbose 'Default' opID=2ccc1c6-bc user=vpxuser] AdapterServer: target='vim.PerformanceManager:ha-perfmgr', method='queryAvailableMetric'
<166>2015-01-15T01:27:21.208Z esx01 Vpxa: [FFA171A0 verbose 'vpxavpxaVmomi' opID=2ccc1c6-bc] [VpxaVmomi] SetStatusDone was called with syncGenNo (62962)
<166>2015-01-15T01:27:21.209Z esx01 Vpxa: [FFA171A0 info 'commonvpxLro' opID=2ccc1c6-bc] [VpxLRO] -- FINISH task-internal-15115237 -- -- vpxapi.VpxaService.queryAvailableMetric --
<166>2015-01-15T01:27:21.279Z esx01 Vpxa: [FFF41B70 info 'commonvpxLro' opID=6cf3d017-52] [VpxLRO] -- BEGIN task-internal-15115238 -- -- vpxapi.VpxaService.queryBatchPerformanceStatistics -- 5fded20a-0547-50ac-55b0-56916daa94da
<166>2015-01-15T01:27:21.280Z esx01 Vpxa: [FFF41B70 verbose 'vpxavpxaMoService' opID=6cf3d017-52] Adding querySpec. Had=28, has=28
============================================================================================================================================================

Thanks for the reply. I was afraid #3 would behave as you described which has been exactly why I have been holding off on doing the update. I update bookmarks for each class so that folders of activities for the day can be opened at once. I often have to reset bookmarks as teachers don't always let me know until shortly before their class what they want their students to do in the computer lab. I have been doing this currently by executing a .bat file that copies the 2 files in question, then restarting Firefox. Is it easy enough to unlink the device while I have students so that they can't change the bookmarks, then relink if I need to update bookmarks between classes? Is it time consuming? Would I need to enter anything at each computer? From what I've read, I think I would need to visit each computer and re-enter link keys in order for this to work.

Syslog logging level 0 - 7

hello sir,
i would like to setup a syslog server and the switches will forward the log file to syslog server to analyst.
please kinldy share with me Level 0 (emergency) to Level 7(debugging mode).
which level i should set then only can trace the user login and configuration changes on the switches?
or any configuration that able to track this and send to syslog server?

Hi,
Would the following be something that youre looking for?
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtconlog.html

Syslog logging in CF801

How to enable syslog error logging in CF801?
Its old & documented bug #47314 [http://www.adobe.com/support/coldfusion/releasenotes/mx/knownissues_mx_j2ee_p2.html]
In the ColdFusion MX Administrator,on the Debugging & Logging > Logging Settings page, the Use operating system logging facilities option does not work. If you select it, restarting your application server throws the following error:
log4j:ERROR No syslog host is set for SyslogAppender named "null".
I got the same error.
Are there any solutions to enable it? Can I setup it by hands(edit some files)??
thanks

no such feature outthere, there is a field in the tables that will tell you the time a record was last updated cross reference that to your webserver access logs .. maybe that helps
we use SVN as a source depository for any code. The only way to promote the code form Dev to QA is to have it checked in, hence somewhat being able to identify who changed what

Syslog logging issues

I am having trouble setting up a server for syslogd files on Solaris 10 update 8 (october release, i think). I have this working find on another machine, it has solaris 10 update 7, although I doubt that the difference in Solaris updates is the problem. The working machine is host "Ysera" and the non-working machine is host "malygos".
I have logs coming from a remote host, and I'd like them to be logged to their own log file (travistest). They are coming in through the local4 facility.
Following is the syslog.conf file. This file is identical for both hosts.
### comments ####
local4.debug                     /tmp/travistest
local3.debug                     /tmp/travistest
local1.debug                     /tmp/travistest
*.debug                            /var/adm/messages
*.alert                              root
# These are tabs and NOT spaces, and no trailing whitespace after the actionThe /etc/services file DOES have the line. This is true for both machines.
syslog      514/udpI can verify that remote logging is activated on both:
root@malygos#svccfg -s system-log listprop | grep remote
config/log_from_remote                     boolean true
root@ysera#svccfg -s system-log listprop | grep remote
config/log_from_remote                     boolean true true trueAny idea why Ysera gives a value of "true true true"?? that is crazy talk to me. Also, strangely, look at the /etc/default/syslogd for Ysera (the working machine)
# all those comments that say that this file is deprecated
# The LOG_FROM_REMOTE setting used to affect the logging of remote messages.
# Its definition here will override the svccfg(1M) settings for log_from_remote
# log_from_remote=yeslog_from remote is still commented out!! so how is it still active?
I have altered the /ect/default/syslogd file in the Malygos (non-working) machine to match this, and also to uncomment it and had no luck. I've attempted to use the setprop command to match the "true true true" property and recieved a syntax error. I tried again trying to put quotes are the "true true true", single quotes, ticks, no marks, and nothing works.
Does anyone have any ideas how I can get the remote log to work?? I know that the port is open...
root@malygos#netstat -an | grep 514
    *.514                         *.*                         0            0      49152           0         LISTENI cannot just make Ysera my log server. Both of these machines are development machines and do not carry the "gold" copy of the system files. In order to send a delivery I need to know why Ysera is working so I can duplicate that code for our final product. Thanks ahead of time for any ideas.

Thanks again for the response!!
root@malygos#svcs -a | grep ipf
disabled 13:59:02 svc:/network/ipfilter:defaultipf.conf
root@malygos#cat /etc/ipf/ipf.conf | grep 514
pass in quick proto tcp from pool/700 to any port = 514 keep state
pass in quick proto udp from pool/800 to any port = 514
root@ysera#more /etc/ipf/ipf.conf
#ipf.conf
# IP Filter rules to be loaded during startup
# See ipf(4) manpage for more information on
#IP Filter rules syntaxDespite the IP filter being disabled, I think that these files being so different is a sign of something. I'll have to check with the team to see why they are different, because I dont' think that they are supposed to be!! (let me know if i'm chasing a ghost again)
The machines are on the same subnet, and I have used Malygos to send message OUT and have other Ysera recieve them...and that works fine. It will not work backwards though, so I agree it's a blocked port or perhaps some of the scripts that start syslogd are not providing the -r option as I expect. A big part of me just wants to jump to Ysera and make that our baseline...but I need to be able to replicate the files. Currently I'm trying to alter /lib/svc/method/system-log to force the -r option. (no worries...I kept the original :-)
I'm also trying to get it to log the parameters that syslogd is started with...so I know exactly what the computer THINKS its doing.
Thanks again dude!!
Edited by: mandarbshadar on Mar 2, 2010 10:34 AM

SYSLOG LOGGING PROBLEMS !!!!

Hi ALl,
I am trying to configure a syslog server to log messages from the routers.
I am trying on the first router, and i issue the command :
LOGGING (syslog ip address)
So now the messges should be sent to the syslog server.
Now supposingly i want to capture the events when an access-list is met namely the DENY IP ANY ANY .... so i should issue the DENY IP ANY ANY LOG command right ??? the LOG keyword should force the router to log the event every time this is met. However i try to do illegal traffic to trigger the DENY IP ANY ANY LOG but it does not show anything logged in the show run, or on the syslog server.
I know the syslog works fine as it logs the messages
that i have configured the router from my ip address.
Is there something i am missing here ???
Please help ,
Thanks,
George

Hi,
What trap level have you set on the router??? After going in the configure terminal mode issue the command "logging trap 7" so that you'll get all the messages which are sent.
If would be better if you could post your config.
Hope it helps.
Please rate helpful posts.
Regards,
AbhisheK

Syslog - log parsing

Similar Messages

Maybe you are looking for