unable to subscribe to a remote syslog collector

dmassie51 · ‎04-01-2008

I am running Cisco Works versions:

Integration Utility 1.7.1

CiscoWorks Common Services 3.1.1

CiscoWorks Assistant 1.0.1

Internetwork Performance Monitor 4.0.1

Campus Manager 5.0.2

LMS Portal 1.0.1

CiscoView 6.1.7

Device Fault Manager 3.0.2

Resource Manager Essentials 4.1.1

Health and Utilization Monitor 1.0.0

on the solaris box the server is running on.

I have another solaris box I will be using to collect syslogs. On that box I have the following software running:

Remote Syslog Collector

CiscoWorks Common Services

CiscoWorks Assistant

LMS Portal

This is at the same version level as that on the other box.

Here is my problem:

When I try to subscribe to the remote syslog collector from the server box to the collector box the operation fails with the popup showing the usual message.

I have checked the stuff it suggested and it seems correct to me.

I noticed one thing however. There is no listener on the collector box at port 4444. So, whenever I try to subscribe to the collector on that box, the subscription packed goes nowhere -- being as there is no listener.

So, I have been trying to figure out why that listener does not come up and I am stumped. I set the logging on syslog collector on the collector box to debug and I have snipped out the start up messages and attached it.

There are a couple of things in the log file that may be a problem but I wasn't able to find anything about them in the docs.

I would appreciate any help anyone would care to give.

Thanks,

Dave Massie

Joe Clarke · ‎04-01-2008

The error indicates that the Collector cannot open the syslog log file from which it is to read messages. By default, this is /var/log/syslog_info on Solaris. If this file is not correct, you will have to adjust Collector.properties to point to the correct file. This file must be readable by casuser.

If Collector.properties is configured properly, and the syslog log file exists, and the permissions are correct, check the permissions of all parent directories back to root. They must all be 0755 or better.

dmassie51 · ‎04-02-2008

Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you!

You are exactly right!

I changed the ownership and permissions of the syslog_info file, restarted the services, and the listener came up correctly.

I was able to successfully subscribe to the collector.

Everything is working correctly.

The problem was I had installed syslog-ng on the box and never went back to look at the syslog_info file (other than to check that syslog-ng was writing to it).

Anyway, thank you very much for your help!

Dave Massie

mmioneatdtcc · ‎10-14-2010

Joe,

thanks for the post - I spent weeks t-shooting this with TAC. Was able to remedy a fix quickly and get this up and running.

Regards,

Michael Mione