Remote Syslog collector

Answered Question
Jul 21st, 2009


I have LMS 3.0.1 installed all application of LMS in one server,

I want to have a dedicated remote syslog collector , user guide says that u must install a RSAC located on LMS DVD while installing RSAC it gives an error that common services should be installed with LMS portal and cisco works assistant,As when i step to do this it takes me to whole thing as like of fresh installion when i choose custom installation,Is it am on the right path ????

Installing common services for remote syslog collector would not conflict with the existing common services 3.1.1.????

Correct me with the proper guidelines to install remote syslog collector,i have read Installing and Getting Started With CiscoWorks LAN Management Solution for remote syslog collector.


Correct Answer by Joe Clarke about 7 years 7 months ago

I cannot reproduce. I can open my syslog.log in notepad just fine with Daemon Manager running. You could also try using the logview utility to get a running tail of the syslog.log file. Just run logview.exe from a DOS prompt. You can then watch this screen for new messages to arrive.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Joe Clarke Wed, 07/22/2009 - 09:07

The RSC cannot be installed on a box with LMS. RCS requires its own machine, and will require its own Common Services installation. If you already have LMS (i.e RME) installed on a server, then you have a syslog collector. That syslog collector can be used for both a local collector (i.e. for the local SyslogAnalyzer) and as a remote collector (for another SyslogAnalyzer).

If you want to install RSC on its own box, then just follow the install guide to put Common Services 3.1 and RSC from the DVD on this box. You can then apply the LMS 3.0.1 update on top of that.

lambay2000 Wed, 07/22/2009 - 12:21

Hi clarke,

I have gone through User guide for installing remote syslog collector,

I have installed LMS 3.0 on a different dedicated server for syslog with common services 3.1.1,cisco works assistant 1.0.1,and LMS portal 1.0.1 and also with a Dec 2007 update,after that i have installed RSAC pack from the LMS 3.0 DVD.

i have created a certificate on my existing LMS server which is with RME,Common services,DFM,IPM,CM,Cisco Assitant,LMS portal with dec 2007 update.Also i created a certificate on syslog server newly installed and imported a certificate from the new Syslog and also from the existing LMS server.After that i subscribe the RME( existing server) with the newly syslog server and it has been done sucessfully.

Now on RME>syslog collector status> I have 2 entries one is the local RME and the other is the newly installed syslog.

In the user guide it says me to edit the setting in collector syslog properties file on newly syslog server according to the time zone,country,offset time,but this changes has not been done by me for the local syslog on RME 6 months back when i installed LMS.the file is as it is i did'nt change any country and offset but still i receive proper date and time for any syslog.

I haVE DONE THE changes in syslog collector properties file according to country code and offset on my new syslog server.

I dont know how to verify my new syslog collector server where i can find the syslog on the new server????.


Joe Clarke Wed, 07/22/2009 - 12:24

You shouldn't have to modify As for your question, I don't understand what you're asking. What "syslog" do you want to find on the new server?

lambay2000 Wed, 07/22/2009 - 12:41


I mean to say that Network devices are configured to send syslogs messages,i want to see that logs on my new syslog collector server,where i can find that logs in my new server.

Currently syslogs are send to RME,

I have to change the configuration on network devices to send traps to new syslog collector server????? i mean to say Logging X.X.X.X OR the RME will collect locally as well on remote syslog collector.


Joe Clarke Wed, 07/22/2009 - 12:44

For Windows, the log is NMSROOT\log\syslog.log. If you have both the local and remote syslog collectors registered to the RME SyslogAnalyzer, then RME will process messages from both servers.

lambay2000 Wed, 07/22/2009 - 13:16

I have subscribe both the syslogs i.e local on RME and remote syslog collector server,

I checked this log file by shutting the power supply for one of the network device,the syslog is been seen on local RME server>device center>device name>syslogs messages.

As it does'nt allow to open the syslog.log file on running RME because it is in use.when it is showing me on a particular device that means it has been received by syslog.log,am i write ????But when i try to open (NMSROOT\log\syslog.log)on new syslog server it does'nt gave me error (i.e file is in use) and i did'nt found the recent log.


Joe Clarke Wed, 07/22/2009 - 13:31

It may take a few minutes for the messages to appear in the syslog.log file. This is due to the way buffers are handled. Some of these buffer issues have been addressed in LMS 3.2. Of course, in order to see the syslog messages in both syslog.log files, you would need to make sure the devices are sending syslog to both servers. This is inefficient, though. Really, devices should only send to one server (maybe based on geography).

In order to open a syslog.log file, you need to use notepad. Other applications may fail if the file is in use.

lambay2000 Wed, 07/22/2009 - 14:06

I will try by configuring additional statement for logging X.X.X.X AND I WILL UPDTAE u, BUT

clarke i tried many times before to open in notepad syslog.log file while cisco works daemon is running,it shows me the error the file is in use with cisco works daemon,then what i use to do,stop the service and i use to opened the file but as i told u my new server is subscribe to RME than why the syslog.log file is been openend while the cisco works daemon is running.


Correct Answer
Joe Clarke Wed, 07/22/2009 - 14:12

I cannot reproduce. I can open my syslog.log in notepad just fine with Daemon Manager running. You could also try using the logview utility to get a running tail of the syslog.log file. Just run logview.exe from a DOS prompt. You can then watch this screen for new messages to arrive.

lambay2000 Wed, 07/22/2009 - 14:19

Hey clarke,

Thanks for all ur support,currently mailing through home,definately i will troubleshoot the syslogs config from ur last 2 mail's and will close the case.

Thanks dear catch u later.

lambay2000 Fri, 07/24/2009 - 12:15

Hi Clarke,

The issue is solved i added a command

logging X.X.X.X for the new syslog collector,log's are been recieved by the syslog,also am able to open syslog file while daemon manager running.

Thanks clarke


This Discussion