I would like to use reload reports so that when devices are restarted (syslog messages will be sent to the syslog collector) a report can generated based on these syslog messages. Via the report generator one can use the predefined reload report based on the syslog descriptions. So far so good (something like * 5 COLDSTART *, SYS * 5 RESTART *, SYS * 5 RELOAD *)
BUT I noticed a problem. When a device restarts a part of the syslog messages (during starting up) are not received by the CW syslog collector. This means that creating a report based on the specific syslog messages will always be empty because these syslogmessages are not received. Is there a way to delay syslogmessages from sending them to the CW after a stable startup of the device is received. (the syslog messages are logged in the devices)
How can a syslogmessage like RESTART or COLDSTART be send successfully during the startup phase?
Have someone experience with that?
At this time, there is not. If the syslog messages don't make it to the device, then the reload report will not show anything.
However, if your device supports the Embedded Syslog Manager, you could write an ESM filter that queues the messages on the router side until they can be sent to RME. This isn't something I've done myself yet, but I see no reason why it shouldn't work. More on ESM can be found at http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a00801a8516.html .
This is one of the those feature *losses* after "upgrading" from LMS 2.2 to 2.5+
With the Syslog-based Reload Report in LMS 2.6, it's basically useless in reporting "reloads" that are due to crashes and such.
The SNMP-based (sysUpTime) Reload Report in LMS 2.2 is no saint, either. It reports false reloads, due to CSCdy02471: The 32-bit sysUpTime counter resets to zero after a device has been up for 1 year, 18 weeks, 6 days, 2 hours, 27 minutes, 52 seconds, and 95 hundreths of a second.
Either way, it's a very ugly situation.