syslog collector status all zeros

js88888888 · ‎04-08-2009

Hello,

I'm running RME 4.0.6 and used to get notifications via Automated Actions for specific facilities/keywords but those haven't come in a while. I checked the Syslog Collector Status and all columns have a zero count. This doesn't seem normal but hey I could be wrong....

thanks

js

Joe Clarke · ‎04-08-2009

Is this on Windows or Solaris?

js88888888 · ‎04-08-2009

This is on windows.

Joe Clarke · ‎04-08-2009

Check the syslog.log to see if new messages are arriving in this file. Make sure the crmlog service is running, and bound to UDP port 514.

js88888888 · ‎04-08-2009

The syslog service is running. However, the syslog.log file shows it is 4.3GB and was last modified on 3/12/09. I can't open it due to its size. Would this be the problem? Plenty of CPU and memory available.

Joe Clarke · ‎04-08-2009

You should consider zeroing it out. Stop the crmlog service, then run:

pdterm SyslogCollector SyslogAnalyzer

Then run:

logrot_trunc NMSROOT\log\syslog.log

That will zero out the file. Then restart the crmlog service, and run:

pdexec SyslogCollector SyslogAnalyzer

Then watch the file to see that new messages arrive. If they do, the syslog counts should increment.

js88888888 · ‎04-15-2009

Thanks much, this did the trick. Can this be scheduled via Ciscoworks or RME? Or somehow automatically managed?

Joe Clarke · ‎04-15-2009

You can configure logrot.pl to do this automatically. Consult the Common Services online help for more details on configuring logrot. Just search for "logrot". Once you have it configured, you can schedule it with the Windows AT command.