cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1152
Views
0
Helpful
7
Replies

syslog and hosts file

egomezelvira
Level 1
Level 1

Hello,

I am using CW LMS 2.6. I have managed my devices using the IP Address. i have all my devices and their IPs in the /etc/hosts file (OS Solaris 9).

My problem is that i made a mistake in that file and put the same name to two IPs (10.10.1.1 and 10.10.1.2 for example had EX name).

When i tried to see syslog messages for that two devices, i see all messages (i suppose that are syslogs from the two devices) only in one device (10.10.1.1) and no messages in the other device. I suppose that it makes the relation between IP and name only for the first entry in the hosts file and enters all the messages as they were only from that device.

if i watch for syslog in the syslog_info file i see that syslog messages are arriving with that name (EX).

I have deleted the devices in CiscoWorks, and i have corrected the mistake in the hosts file (now 10.10.1.1 has EX1 and 10.10.1.2 has EX2) and i have managed the devices once more but now, although syslog messages are arriving to CW (i have done an snoop) i cannot see them in the CiscoWorks, nor in the syslog_info file because they continue arriving with EX name.

I have rebooted CW but nothing matters.

What can i do???

Thank you very much in advanced.

7 Replies 7

Joe Clarke
Cisco Employee
Cisco Employee

You should use the resolver.pl script that comes with CiscoWorks to make sure those IP addresses really resolve to different names:

NMSROOT/bin/resolver.pl

Next, when you say you rebooted CW, does this mean you rebooted the server, or simply restarted dmgtd? If the latter, you might try restarting syslogd and nscd on the Solaris server (or do an actual reboot).

it resolves ip-names perfectly and i have rebooted the server, not only CiscoWorks daemon. Any idea?

I'm a little perplexed about your last sentence, so let me get some clarification before moving further:

"although syslog messages are arriving to CW (i have done an snoop) i cannot see them in the CiscoWorks, nor in the syslog_info file because they continue arriving with EX name."

Does this mean the messages do NOT show up in syslog_info AT ALL, or does this mean they DO show up, but sourced from the EX hostname?

Sorry. They don?t appear at all.

Please provide a ps -efl from the system.

OK, here you have.

Thanks.

Please provide /etc/syslog.conf and a sniffer trace showing these messages arriving on the server. I have a strong feeling the messages are being sent with the wrong facility.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco