09-17-2008 03:25 AM
Hi gents
I have the following problem:
we've got CW LMS 2.6, RME 4.0.6, DFM 2.0.11.
Today I occassionaly noticed that CW doesn't have any received syslog messaged for one 3750 switch. I checked the switch and tested sending syslog messages to another syslog server - everything fine.
At the same time CW has syslog messages for all other devices.
I checked credentials for problem devices - fine, checked system configuration archive - ok, but if I try to get Fault History report for this switch in DFM I receive the following error:
"Cannot generate Fault History display.
User has no access to the device."
So, there is something incorrect configured at my server. any idea?
Thanks you,
Solved! Go to Solution.
09-18-2008 09:58 PM
Yes, you have to first verify the messages are making it to the server, then you need to check the SyslogCollector.log to make sure they're being processed correctly.
09-17-2008 04:57 AM
just tried to remove and add it back - nothing changed. I still don't receive syslogs and still can't get fault history report.
09-17-2008 07:32 AM
DFM has nothing to do with syslog. Do you want to look at the DFM fault history issue, or do you want to troubleshoot the syslog problem in this thread?
09-17-2008 07:25 PM
both. It was strange for me that both things don't work for the same device.
but syslog has more priority for me as we need to trace any changes.
09-17-2008 09:07 PM
First, check the syslog message file to make sure this switch's messages are actually making it to the server. If so, post a message that makes it to this file, but does not appear in the syslog report. Also, post your NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/filters.dat
file.
09-17-2008 10:16 PM
09-17-2008 10:37 PM
Yes, the filters are fine. What do you mean that the message is received by the second configured logging server? Does the message show up in the CiscoWorks' servers message file (i.e. /var/log/syslog_info on Solaris or syslog.log on Windows)?
09-18-2008 01:59 AM
I meant that I configured the second logging server on that switch just to make sure that swtich sends syslog messages.
How can I decrease the size of the syslog.log file? I run purge for syslog for all messages, but the size is still the same, 11Gb
09-18-2008 05:49 AM
You can rotate the log file using NMSROOT\bin\logrot.pl. Logrot's documentation can be found in the Common Services online help. Just search for logrot. Basically, you'll configure logrot using NMSROOT\bin\perl NMSROOT\bin\logrot.pl -c. Once you have it configured, just run NMSROOT\bin\perl NMSROOT\bin\logrot.pl to rotate the configured log files.
09-18-2008 07:16 AM
ok, thank you. I will use your advice. for the moment I just renamed the old syslog.log file to new name and after starting cwcs syslog service I have got new syslog.log file.
And I see syslog messages coming from problem switch. So why I don't see them in CW?
09-18-2008 07:21 AM
Now you need to edit NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/Collector.properties, set the DEBUG_LEVEL to DEBUG. Then restart SyslogCollector. Generate a new message, and verify it makes it to the syslog.log. Then post the message and the SyslogCollector.log.
09-18-2008 08:43 PM
Joe, How do I restart SyslogCollector?
09-18-2008 09:06 PM
pdterm SyslogCollector SyslogAnalyzer
pdexec SyslogCollector SyslogAnalyzer
09-18-2008 09:22 PM
09-18-2008 09:25 PM
You need to restart the SyslogAnalyzer process as well so that SyslogCollector starts processing the syslog.log file. Use the commands I posted. You also need to post a message that was generated, and showing up in the syslog.log file, after you restart these processes.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide