LMS 2.6 Syslog Fowarding Issues

rcurran02 · ‎01-29-2008

I am trying to forward syslog messages to another server using an Automated Action to a script. I am getting an error unable to execute script.

Here is my perl script (foward1.pl):

#!/CSCOpx/bin/perl

use strict;

use Sys::Syslog qw(:DEFAULT setlogsock);

my $msg = $ARGV[0];

setlogsock('inet');

$Sys::Syslog::host = '10.28.34.101';

syslog('info|local7', $msg);

closelog;

Here is my batch I call from the Automated Action (forward.bat):

@ECHO OFF

d:\cscopx\bin\perl.exe d:\CSCOpx\files\scripts\syslog\forward1.pl "%~2"

I am running LMS 2.6 and RME 4.0.5 on Windows 2003 SP2

rcurran02 · ‎01-29-2008

Here is the error in the AnalyzerDebug.log

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-1],Will execute "D:/CSCOpx/files/scripts/syslog/forward.bat" "FARMI-MI-WB6101" "Jan 29 13:02:43 10.182.16.129 2652: Jan 29 18:02:40: %LINK-3-UPDOWN: Interface FastEthernet1/0/14, changed state to up"

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-2],Attempting to process new syslogs from the collector

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-1],The String to be Parsed : "D:/CSCOpx/files/scripts/syslog/forward.bat" "FARMI-MI-WB6101" "Jan 29 13:02:43 10.182.16.129 2652: Jan 29 18:02:40: %LINK-3-UPDOWN: Interface FastEthernet1/0/14, changed state to up"

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-2],Attempting to find the device id

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-2],Preparing to find device id by assuming 10.182.16.129 as address

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-2],Finding device id in the cache

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-2],Device id found in the cache itself as 1642

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-1],D:/CSCOpx/files/scripts/syslog/forward.bat

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-2],Found the device id as 1642

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-1],FARMI-MI-WB6101

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-2],Attempting to insert the syslog into database

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-1],Jan 29 13:02:43 10.182.16.129 2652: Jan 29 18:02:40: %LINK-3-UPDOWN: Interface FastEthernet1/0/14, changed state to up

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-2],Preparing to hand of syslog to the database handler

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-2], Time stamp of the syslog received is : Tue Jan 29 13:02:43 EST 2008 GMT 29 Jan 2008 18:02:43 GMT

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-2],Insert into SYSLOG_20080029(Syslog_Device_Id,Syslog_Device_Name,Syslog_TimeStamp,Syslog_Facility,Syslog_SubFacility,Syslog_Severity, Syslog_Mnemonic,Syslog_Description )values ( '1642','10.182.16.129','2008-01-29 18:02:43','LINEPROTO',null,'5','UPDOWN','Line protocol on Interface FastEthernet1/0/14, changed state to up' )

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-2],Recreated the statement object

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-2],Added syslog to the database handler

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-2],Insertion of syslog into database is done

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-2],Attempting to find interested actions, bypassing

[ Tue Jan 29 13:03:03 EST 2008 ],DEBUG,[Thread-2],Found 3 actions on the syslog

[ Tue Jan 29 13:03:03 EST 2008 ],ERROR,[Thread-1],Unable to execute script. Exception is -

java.io.IOException: CreateProcess: D:/CSCOpx/files/scripts/syslog/forward.bat FARMI-MI-WB6101 "Jan 29 13:02:43 10.182.16.129 2652: Jan 29 18:02:40: %LINK-3-UPDOWN: Interface FastEthernet1/0/14, changed state to up" error=5

at java.lang.Win32Process.create(Native Method)

at java.lang.Win32Process.(Win32Process.java:68)

at java.lang.Runtime.execInternal(Native Method)

at java.lang.Runtime.exec(Runtime.java:566)

at java.lang.Runtime.exec(Runtime.java:491)

at java.lang.Runtime.exec(Runtime.java:457)

at com.cisco.nm.rmeng.sa.actions.RmeSaScriptHandler.runScript(RmeSaScriptHandler.java:389)

at com.cisco.nm.rmeng.sa.actions.RmeSaScriptHandler.act(RmeSaScriptHandler.java:179)

at com.cisco.nm.rmeng.fcss.actions.FcssActionProcessor.handOff(FcssActionProcessor.java:131)

at com.cisco.nm.rmeng.fcss.actions.FcssActionProcessor.process(FcssActionProcessor.java:113)

at com.cisco.nm.rmeng.fcss.actions.FcssActionProcessor.run(FcssActionProcessor.java:155)

Joe Clarke · ‎01-29-2008

You need to modify the permissions on C:\WINDOWS\system32\cmd.exe to allow casuser to execute it (i.e. add Read & Execute permissions).

rcurran02 · ‎01-29-2008

That worked thanks alot for your help!!