Solved: Do I really have to subscribe to the syslog collector to report on syslogs?

mssnider · ‎11-12-2008

I tried to run some syslog reports and there was no information for my devices. I know there were syslogs reported though, you can see them in the logs of the devices. I found that the syslog collector status page and discovered that nothing was subscribed. We have configured our cisco equipment to send syslogs to our LMS server. So, I subscribed to the very server I was on. I checked the reports and the syslog information was properly displayed.

In LMS 2.x, there was no such thing as this 'subscription.' The syslogs were always received and reported on.

I also discovered that the subscription is removed when you stop and start the daemon mgr. So, you have to manually go back in and subscribe again.

Is this really how this functions? Do I really have to subscribe to myself in order to report on the syslogs? If so, can I set up something to make this automatic?

Thanks...

Joe Clarke · ‎11-12-2008

Yes, this is your issue. It does not appear the hostname change was done properly. Re-run:

NMSROOT/bin/perl NMSROOT/bin/hostnamechange.pl

Then, with Daemon Manager shutdown, delete the contents of the collectors.dat file I mentioned previously. Restart the Daemon Manager, and resubscribe to your Collector if needed. Then restart again, and see if the subscription sticks.

View solution in original post

Joe Clarke · ‎11-12-2008

Yes, you need to be subscribed to a SyslogCollector. This is new to LMS 2.5 and higher as we added the ability for multiple SyslogCollectors to be registered to a single SyslogAnalyzer AND for multiple SyslogAnalyzers to be registered to a single Collector.

As long as the daemons come up together, there should be no need to re-subscribe. The Analyzer stores the list of registered Collectors in NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/sa/data/collectors.dat. When the Analyzer initializes, it reads this file, and automatically resubscribes to all of the configured Collectors.

If you are running RME < 4.0.6 then you may be seeing a bug where the Analyzer takes a long time to initialize. However, if you wait, it should properly resubscribe to the Collector.

mssnider · ‎11-12-2008

Thanks for the quick response. Both of our LMS 3.0 - RME 4.1.1 systems do not automatically subscribe. It may have something to do with my attachment.

When the server was built, the unix admin entered xxxx-new as the hostname. We have since gone through the hostname rename process. However, the xxxx-new hostname is always listed in the Syslog Collector Status page.

I'm grasping at straws I guess, but it may be causing part of my issue?

Joe Clarke · ‎11-12-2008

Yes, this is your issue. It does not appear the hostname change was done properly. Re-run:

NMSROOT/bin/perl NMSROOT/bin/hostnamechange.pl

Then, with Daemon Manager shutdown, delete the contents of the collectors.dat file I mentioned previously. Restart the Daemon Manager, and resubscribe to your Collector if needed. Then restart again, and see if the subscription sticks.

mssnider · ‎11-12-2008

That did it...

I ran the hostnamechange.pl script, but it errored out informing me that the new hostname is the same as the old one.

So, I continued on and cleared out the collectors.dat file. Once the daemon mgr was restared, there was only one collector and it was already subscribed.

Thanks a lot...