cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
854
Views
0
Helpful
6
Replies

CWCS Syslog Service Stops Automatically when started

connect
Level 1
Level 1

We are using LMS 3.0.1. Presently we are using a RSAC (remote syslog collector) and running the analyzer in the LMS server running RME. Recently we are experiencing that the CWCS Syslog Service fails to start by throwing a message "Some services stop if they don't have any work to do"whereas the pdshow command shows the SyslogAnalyzer service to be running. Also checked that none of the syslog database files (SyslogFirst.db, SyslogSecond.db and SyslogThird.db)are getting updated althouth the collector registration status is successfull and messages are also getting updated in the collector.

Pls help...

6 Replies 6

Joe Clarke
Cisco Employee
Cisco Employee

This typically points to some other service bound to UDP port 514. Check the output of netstat -a -n -o -b to see what process that is. Stop this process, then start crmlog, and syslog processing should start to work.

I tried this and found the service "crmsh.exe" running on port UDP 514 so i stopped the service "CWCS rsh/rcp service" and found that no service is running on port 514 and then tried starting the service "crmlog" using the command "net start crmlog" but it failed to start without even reporting any error.

Also when I look into the "SyslogAnalyzer.log" file under the log directory i found the below mentioned messages stating it could not connect to the DB. Pls help.

com.cisco.nm.rmeng.sa.common.SAException: Could not connect to DB!

at com.cisco.nm.rmeng.sa.SyslogAnalyzerEngine.(SyslogAnalyzerEngine.java:299)

at com.cisco.nm.rmeng.sa.SyslogAnalyzerService.main(SyslogAnalyzerService.java:105)

No, crmrsh binds to TCP port 514. This is fine. Post the output of netstat -a -n -o -b from this server along with the SyslogAnalyzer.log and the output of the pdshow command.

my apologies for delayed response. All the requested outputs are attached herewith for your reference and suggestion.

There does not appear to be a current issue with SyslogAnalyzer. The problem with syslog is that crmlog is not starting. Check the Windows Event Viewer for any crmlog-related errors. Also, check the syslog_debug.log for any errors after you try and start the crmlog service.

Thanks for your indication, the problem is resolved. It was happening bcos it was not able to find the syslog.log file in the specified path. I have other problems as well but will post that in a new thread.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco