cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1805
Views
10
Helpful
33
Replies

Questions after LMS 2.6 upgrade from LMS 2.2

yjdabear
VIP Alumni
VIP Alumni

1. Is there a GUI counterpart to modifying NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/Collector.properties? I can't find it. Is LMS 2.5/2.6 (RME 4.x) supposed to pick up the custom syslog_info location from LMS 2.2 (RME 3.5)? If there's no GUI, how do I make LMS 2.6 re-read Collector.properties, without restarting dmgtd?

2. Is DCR supposed to pick up the entire RME 3.5 inventory and all custom "Views" during the LMS 2.2 -> 2.6 (via Dec05 update) upgrade? DCR is missing about 20% of the devices after the upgrade. Aftering importing the full inventory via a csv file, I get duplicates: one with just the hostname, one with hostname.fqdn.com. Even if I have All Devices folder checked, my search for which devices with names containing "fqdn.com" (the ones imported via the csv) returns nothing.

1 Accepted Solution

Accepted Solutions

What is PID 1006? I don't think this is SyslogCollector.

View solution in original post

33 Replies 33

Joe Clarke
Cisco Employee
Cisco Employee

1. There is no GUI counterpart, but LMS 2.6 does offer a script, NMSROOT/bin/syslogConf.pl that allows one to configure many of the properties in Collector.properties. This script requires dmgtd to be down. However, if you modify Collector.properties directly, all you need to restart is SyslogCollector.

2. Yes, the upgrade should preserve the full inventory from RME 3.5. Importing a CSV file from RME 3.5 into a clean DCR should not result in duplicates. However, if you already had some of the devices in DCR, then duplicates can occur. DCR does not do any resolution of duplicates itself. It leaves that task up to the other applications. How and where did you do the fqdn.com search?

1. My syslog_info is on a read-only NFS export mounted on the LMS server. I had modified Collector.properties and restarted dmgtd earlier. It didn't work. I ran the pretty barebone syslogConf.pl, got this output:

Enter Your Choice: 4

INFO: You have opted to change Syslog File Location

Old Sylog Directory : /var/log/

Enter Full Path of New Syslog Directory: /var/adm/CSCOpx/syslog/

chown: /var/adm/CSCOpx/syslog/syslog_info: Read-only file system

chmod: WARNING: can't change /var/adm/CSCOpx/syslog/syslog_info

Sylog file location changed from: /var/log/

to: /var/adm/CSCOpx/syslog

Here's SyslogConf.log:

----------------Change Sylog File Location-----------------

Create new Syslog Directory

newSyslogLoc /var/adm/CSCOpx/syslog/

newSylsogLoc /var/adm/CSCOpx/syslog

Cannot Open File /var/adm/CSCOpx/syslog/syslog_info

Cannot Close File /var/adm/CSCOpx/syslog/syslog_info

---------Change Sylog File Location in syslog.conf------

Updated /etc/syslog.conf.

Updated /opt/CSCOpx/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/cs

c/data/Collector.properties.

----------------Change Sylog File Location in logstat.conf-----------------

Must I mount the syslog as read-write? What permissions does SyslogCollect expect syslog_info to be? The syslog_info itself is a symlink pointing to the real syslog file on the other box, since another app is using the original and Solaris won't let one file read by two procs concurrently. The symblink's permission is 777, while the original is as follows:

-rw-r--r-- 1 root other

This arrangement has worked fine with LMS 2.2.

Does installing a Device Update pkg for CiscoView have the same effect as restarting dmgtd?

Using an external syslog_info on a read-only file system was not test, and thus not supported. I can't say if this will work in LMS 2.6 or not. The error above indicates that it will not. However, the perms that syslogConf.pl tries to set are casuser:casusers 0664. However, this isn't needed as the standard syslog_info perms are root:sys 0664. You might try enabling debugging in Collector.properties, and see if there are any obvious errors when SyslogCollector tries to use this file.

As for CiscoView package installation, it is not quite the same as a dmgtd restart. PSU will actually stop all the daemons by hand, then restart them ALL (even the transients). dmgtd itself never stops. But for purposes of restarting the application daemons, it is sufficient.

Re-reading the error message, it seems as if SyslogCollector was trying to create a directory.

Is setting Logging Level to Deubg in RME->System Pref->Loglevel Settings-> SyslogAnalyzer the GUI equivalent to turning on SyslogCollector debugging?

A new question: There's a way to modify a config file so CM 4.x User Tracking displays more than the default max of 1000 entries per page, right? I recall the max is 3000, though a search for "3000 tracking" turns up nothing.

No, the only way to enable SyslogCollector debugging is in Collector.properties. This will be changed in LMS 3.0.

The maximum number of entries per page in UT cannot be changed. This value is hard-coded.

Attached is a snippet of /var/adm/CSCOpx/log/SyslogCollector.log

No change in SyslogConf.log.

There is no indication of any problem here. It just looks like no new messages arrived in the syslog_info file. The daemon is properly starting, and does appear to have successfully opened the file. You can confirm that by using lsof on the PID of SyslogCollector.

I see the NFS mount opened:

cwjava 24267 casuser 11r VREG 322,1 84716087 172 /var/adm/CSCOpx/syslog (prod-nms:/var/logs/)

I can see the /var/adm/CSCOpx/syslog/syslog_info getting new syslogs from the CLI, so could LMS 2.2. Doesn't this mean it's a defect in LMS 2.6's SyslogCollector?

Can Remote SyslogCollector read a local file such as /var/logs/blah/blah/infolog, or is it hardcoded to /var/log/syslog_info? I think I might have to start exploring the RSC route.

There can be no defect since this configuration isn't officially supported. But I've seen no errors so far to indicate the cause of the problem.

SyslogCollector can read from any file. It is not hardcoded to syslog_info. But it looks like to specify a different file name, you will have to modify Collector.properties directly, then restart SyslogCollector.

The RSC option would be the supported way of doing this.

I must be missing a step or something. Even having SyslogCollector reading a local original /var/log/syslog_info doesn't seem to make it collect. Nothing is recorded by SyslogCollector's debug either.

How are the new messages getting into this local syslog_info? Provided that the Collector.properties points to this file, SyslogCollector has been restarted since making the modifications, and the permissions allow SyslogCollector to read the file, you should get the messages processed (or at least filtered).

The issue with local /var/log/syslog_info seems related to a problem with NMSROOT/bin/syslogConf.pl. I don't know why I'm the only one that seems to experience this, but apparently if I use NMSROOT/bin/syslogConf.pl to configure syslog location, it puts in blank spaces instead of tabs when entering "local7.info /var/log/syslog_info" in /etc/syslog.conf (seen with ":set list" in vi).

******************

/opt/CSCOpx/bin/perl /opt/CSCOpx/bin/syslogConf.pl

...

[Q] Quit

Enter Your Choice: 4

INFO: You have opted to change Syslog File Location

Old Sylog Directory : /var/log/

Enter Full Path of New Syslog Directory: /var/log

Sylog file location changed from: /var/log/

to: /var/log

[1] Change Syslog Analyzer Port

[2] Change Syslog Collector Port

[3] Configure Remote Syslog Collector(RSAC) Address and Port

[4] Change Syslog File Location

[Q] Quit

Enter Your Choice: Q

INFO: You have opted to Quit..

INFO: For more information, please check the log file /var/adm/CSCOpx/log/SyslogConf.log

INFO: Please restart syslog service [/etc/init.d/syslog stop , /etc/init.d/syslog start].

INFO: Please restart daemon manager [/etc/init.d/dmgtd start].

/usr/sbin/syslogd -d

...

writemsg(7): Logging msg 'syslogd: line 35: unknown priority name "info /var/log/syslog_info"' to FILE /var/adm/messages

init(1): accepting messages from local system

set_udp_buffer(1): allocate 262144 for fd 3

init(1): accepting messages from remote

init(1): syslogd: started

main(1): off & running....

hostname_lookup(17): hostname_lookup started

net_poll(18): net_thread started

net_poll(18): received message from 172.18.1.4.197.232

172.18.1.4 is a lab router on which I did a "conf t" to generate a sys-5 syslog, of course.

vi /etc/syslog.conf

...

$

# Added for Cisco Syslog Analyzer (begin)$

local7.info /var/log/syslog_info$

# Added for Cisco Syslog Analyzer (end)$

local1.info^I^I^I^I/var/adm/messages$

#BEGIN CSCOmd - DO NOT EDIT THESE COMMENTS OR CONTENTS CONTAINED WITHIN - local2 1$

#$

local2.emerg;local2.alert;local2.crit;local2.err;local2.warning;local2.notice;local2.info;local

2.debug^I/var/adm/CSCOpx/log/dmgtd.log$

#$

#END CSCOmd DO NOT EDIT BEFORE THIS LINE 1$

:set list

Upon switching to tabs:

net_poll(19): received message from 172.18.1.4.197.232

writemsg(12): Logging msg '132: *Apr 5 11:01:42.524: %SYS-5-CONFIG_I: Configured from console by my-tacacs-id on vty0 (10.254.74.1)' to FILE /var/log/syslog_info

Also, I notice the #BEGIN CSCOmd section used to be all local0 with LMS 2.2. Is LMS 2.6 switching to local2 instead?

Wow, nice catch on the spaces vs. tabs thing. This is definitely a bug. CSCOmd will use local0 if it is free. Do you have local0 used for something else?

I filed CSCsi42348 to track this problem. A quick fix is to modify line 334 of syslogConf.pl, and change the line to:

$newValue="\t\t".$newValue."\n";

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: