syslog and hosts file

Unanswered Question
May 21st, 2007

Hello,

I am using CW LMS 2.6. I have managed my devices using the IP Address. i have all my devices and their IPs in the /etc/hosts file (OS Solaris 9).

My problem is that i made a mistake in that file and put the same name to two IPs (10.10.1.1 and 10.10.1.2 for example had EX name).

When i tried to see syslog messages for that two devices, i see all messages (i suppose that are syslogs from the two devices) only in one device (10.10.1.1) and no messages in the other device. I suppose that it makes the relation between IP and name only for the first entry in the hosts file and enters all the messages as they were only from that device.

if i watch for syslog in the syslog_info file i see that syslog messages are arriving with that name (EX).

I have deleted the devices in CiscoWorks, and i have corrected the mistake in the hosts file (now 10.10.1.1 has EX1 and 10.10.1.2 has EX2) and i have managed the devices once more but now, although syslog messages are arriving to CW (i have done an snoop) i cannot see them in the CiscoWorks, nor in the syslog_info file because they continue arriving with EX name.

I have rebooted CW but nothing matters.

What can i do???

Thank you very much in advanced.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Joe Clarke Mon, 05/21/2007 - 08:00

You should use the resolver.pl script that comes with CiscoWorks to make sure those IP addresses really resolve to different names:

NMSROOT/bin/resolver.pl

Next, when you say you rebooted CW, does this mean you rebooted the server, or simply restarted dmgtd? If the latter, you might try restarting syslogd and nscd on the Solaris server (or do an actual reboot).

egomezelvira Mon, 05/21/2007 - 08:14

it resolves ip-names perfectly and i have rebooted the server, not only CiscoWorks daemon. Any idea?

Joe Clarke Mon, 05/21/2007 - 08:18

I'm a little perplexed about your last sentence, so let me get some clarification before moving further:

"although syslog messages are arriving to CW (i have done an snoop) i cannot see them in the CiscoWorks, nor in the syslog_info file because they continue arriving with EX name."

Does this mean the messages do NOT show up in syslog_info AT ALL, or does this mean they DO show up, but sourced from the EX hostname?

Joe Clarke Wed, 05/23/2007 - 08:01

Please provide /etc/syslog.conf and a sniffer trace showing these messages arriving on the server. I have a strong feeling the messages are being sent with the wrong facility.

Actions

This Discussion