Solved: LMS 3.1 and ASA 5505

swhite2031 · ‎01-29-2009

I have an issue with an ASA 5505's syslog data being seen in RME. The data is arriving at the LMS server because the data is seen in the unidentified report. The other unusual symptom is the "Device Alert Identifier" has a red exclamation point after the ID number.... Version is 7.2(2)... I have another ASA 5505 running 8.0.(4) that is configured the same but is working correctly... Please don't tell me its a version issue. Thanks in advance.

Joe Clarke · ‎01-29-2009

Good. There is actually another bug filed for this problem, CSCsu88608. THAT bug should be fixed. The problem is once a device is added to the unexpected devices cache, it is not purged once it gets managed by RME. Therefore, SyslogAnalyzer must be manually restarted to purge the cache.

View solution in original post

Joe Clarke · ‎01-29-2009

If messages are showing up in the unexpected devices report, then RME cannot map the messages to a managed device. How do the messages appear in the syslog message log on the server? How is the device showing up in LMS? Please post a screenshot showing this exclamation mark issue. This sounds like something completely unrelated to the syslog issue.

swhite2031 · ‎01-29-2009

Thanks for the quick reply... the syslog message looks like the attachment syslog.txt. LMS does see the ASA.. It was discovered. You are right regarding the exclamation mark, it was an error that this morning the ASA became temporarily unreachable...

swhite2031 · ‎01-29-2009

Issue Resolved... found the answer in the release notes for RME. CSCSa57752 matched my issue exactly... Restarting the syslog analyzer process fixed the issue...

Joe Clarke · ‎01-29-2009

Good. There is actually another bug filed for this problem, CSCsu88608. THAT bug should be fixed. The problem is once a device is added to the unexpected devices cache, it is not purged once it gets managed by RME. Therefore, SyslogAnalyzer must be manually restarted to purge the cache.