Do I really have to subscribe to the syslog collector to report on syslogs?

Answered Question

I tried to run some syslog reports and there was no information for my devices. I know there were syslogs reported though, you can see them in the logs of the devices. I found that the syslog collector status page and discovered that nothing was subscribed. We have configured our cisco equipment to send syslogs to our LMS server. So, I subscribed to the very server I was on. I checked the reports and the syslog information was properly displayed.

In LMS 2.x, there was no such thing as this 'subscription.' The syslogs were always received and reported on.

I also discovered that the subscription is removed when you stop and start the daemon mgr. So, you have to manually go back in and subscribe again.

Is this really how this functions? Do I really have to subscribe to myself in order to report on the syslogs? If so, can I set up something to make this automatic?

Thanks...

Correct Answer by Joe Clarke about 8 years 6 months ago

Yes, this is your issue. It does not appear the hostname change was done properly. Re-run:


NMSROOT/bin/perl NMSROOT/bin/hostnamechange.pl


Then, with Daemon Manager shutdown, delete the contents of the collectors.dat file I mentioned previously. Restart the Daemon Manager, and resubscribe to your Collector if needed. Then restart again, and see if the subscription sticks.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Joe Clarke Wed, 11/12/2008 - 07:59
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Yes, you need to be subscribed to a SyslogCollector. This is new to LMS 2.5 and higher as we added the ability for multiple SyslogCollectors to be registered to a single SyslogAnalyzer AND for multiple SyslogAnalyzers to be registered to a single Collector.


As long as the daemons come up together, there should be no need to re-subscribe. The Analyzer stores the list of registered Collectors in NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/sa/data/collectors.dat. When the Analyzer initializes, it reads this file, and automatically resubscribes to all of the configured Collectors.


If you are running RME < 4.0.6 then you may be seeing a bug where the Analyzer takes a long time to initialize. However, if you wait, it should properly resubscribe to the Collector.

Thanks for the quick response. Both of our LMS 3.0 - RME 4.1.1 systems do not automatically subscribe. It may have something to do with my attachment.

When the server was built, the unix admin entered xxxx-new as the hostname. We have since gone through the hostname rename process. However, the xxxx-new hostname is always listed in the Syslog Collector Status page.

I'm grasping at straws I guess, but it may be causing part of my issue?



Correct Answer
Joe Clarke Wed, 11/12/2008 - 08:10
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Yes, this is your issue. It does not appear the hostname change was done properly. Re-run:


NMSROOT/bin/perl NMSROOT/bin/hostnamechange.pl


Then, with Daemon Manager shutdown, delete the contents of the collectors.dat file I mentioned previously. Restart the Daemon Manager, and resubscribe to your Collector if needed. Then restart again, and see if the subscription sticks.

Actions

This Discussion