CiscoWorks LMS 3.1 RME: Missing historical Syslog data

Answered Question
Aug 18th, 2009

Hi,

Regained access to CiscoWorks, after Apache port conflict error. Now unable to view historical Syslog data.

Please assist.

Thank you,

I have this problem too.
0 votes
Correct Answer by Joe Clarke about 7 years 3 months ago

What error do you see when running a syslog standard report in RME? Or is it you see no messages? It could be that all of the old messages have been purged from the RME database. What are your syslog purge settings? Post a screenshot of RME > Tools > Syslog > Collector Status.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Joe Clarke Tue, 08/18/2009 - 06:27

What error do you see when running a syslog standard report in RME? Or is it you see no messages? It could be that all of the old messages have been purged from the RME database. What are your syslog purge settings? Post a screenshot of RME > Tools > Syslog > Collector Status.

max_gbp777 Tue, 08/18/2009 - 06:43

Hi Jclarke,

I do not get any errors, just no information/ messages for events that occured before yesterday.

Where do I find syslog purge settings?

Screenshot attached.

Thank you,

Joe Clarke Tue, 08/18/2009 - 06:48

The purge settings can be found under RME > Admin > Syslog. Make sure that when you run the syslog standard report that you have not checked the 24 hour box, and instead choose a date range that is less than your configured purge settings.

max_gbp777 Tue, 08/18/2009 - 07:49

Hi Jclarke,

Checked the settings and found that they where set to the default of 7 days. I have now amended this to 180 days. Also changed the backup Policy max. file size to 1024MB.

Are these setting acceptable?

I selected upto a year prior for the Syslog report without result.

If you have any other ideas that would be good, if not we will have to take it forward from here.

Thank you,

Joe Clarke Tue, 08/18/2009 - 08:08

I was finally able to open your attachments, and they look fine. I see no reason why older syslogs were not being stored except for perhaps all your daemon issues.

Moving forward, provided you have the disk space, 180 days of syslog will be fine. After 180 days, the messages will be purged from the database into your backup file. If 1 GB is sufficient to hold all of those messages, and if you have the disk space, that setting is also fine.

I would give this a bit more time now that LMS has stabilized. For example, when you come in tomorrow, run a new syslog report, and make sure you can see today's messages.

max_gbp777 Thu, 08/20/2009 - 06:51

Hi Jclarke,

I have monitored for 2 days and all seems to be stable. I still can't access the historical data but we have data for the past 3 days.

I'll just cross my fingers and hope management don't want to review past reports.

Thank you again for all your help.

Max

Actions

This Discussion