LMS3.0 - Syslog Automated Action for CVPN 3000 Concentrator Series syslogs

Unanswered Question
Nov 25th, 2007
User Badges:

Hi there,

I've just updated a LMS2.6 to LMS3.0 and was wandering that Syslog Automated Actions for Cisco VPN 3000 Series Concentrators stops working. Until LMS2.6 the AUTH-5-22 (Logon) and AUTH-5-28 (Logoff) messages were proceeded as emails . Actually the messages goes into syslog.log but there is no action triggered. Also a 24 hour report for CVPN3000 Concentrators shows no results. The RME 4.1.0 report shows the devices as supported.

Are the CVPN3000 Series Concentrators no longer supported by SyslogAnalyzer?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Joe Clarke Sun, 11/25/2007 - 23:35
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

These devices are still supported by Syslog Analyzer. Assuming the message format is still Cisco IOS, then the syslog system on the server needs to be debugged starting from the lowest level, then working upwards. Since the messages are coming in to syslog.log, you first need to enable SyslogCollector debugging, and verify that they are being properly read from syslog.log. This is done by setting the DEBUG_LEVEL to DEBUG in NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/Collector.properties, then restarting SyslogCollector. The SyslogCollector.log will have the relevant messages once new concentrator messages have been sent to the server.

If the messages are being read correctly by the Collector, and are not being filtered (i.e. they are being forwarded to the Analyzer), enable SyslogAnalyzer debugging under RME > Admin > System Preferences > Application Log Level Settings, then send more messages to the server. The AnalyzerDebug.log will have the relevant debugging messages.

heikamp Mon, 11/26/2007 - 00:25
User Badges:

Hi J.,

thanks for the fast reply. I've set the DEBUG_LEVEL=DEBUG within the Collector.properties file after stopping the SyslogCollecter Daemon. Then I've started the SyslogCollector Daemon. The service started without exceptions. Last entry is: Service started...

A 'tail -f' shows incoming messages from switches and also from the CVPN3000 Concentrators in syslog.log.

There are no filter settings applied - so the defaults are used the SyslogCollector.log file reports.

The SyslogAnalyzer.log shows only the entry of the path for the Collector.properties file - even after setting DEBUG logging level.

heikamp Mon, 11/26/2007 - 03:23
User Badges:

Hi J.,

I've played around with some alternatives and found the trick: I've to restart the SyslogAnalyzer Process: Common Services --> Server --> Admin --> Processes --> [x] SyslogAnalyzer [ Stop ] --> [x] SyslogAnalyzer [ Start ]

After that the syslog entries for the CVPN3000 Series concentrators were emailed and also shown in the 24 hour reports.

Thanks for your assistance!


This Discussion