cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
782
Views
0
Helpful
6
Replies

CiscoWorks LMS 3.1 RME: Missing historical Syslog data

max_gbp777
Level 1
Level 1

Hi,

Regained access to CiscoWorks, after Apache port conflict error. Now unable to view historical Syslog data.

Please assist.

Thank you,

1 Accepted Solution

Accepted Solutions

Joe Clarke
Cisco Employee
Cisco Employee

What error do you see when running a syslog standard report in RME? Or is it you see no messages? It could be that all of the old messages have been purged from the RME database. What are your syslog purge settings? Post a screenshot of RME > Tools > Syslog > Collector Status.

View solution in original post

6 Replies 6

Joe Clarke
Cisco Employee
Cisco Employee

What error do you see when running a syslog standard report in RME? Or is it you see no messages? It could be that all of the old messages have been purged from the RME database. What are your syslog purge settings? Post a screenshot of RME > Tools > Syslog > Collector Status.

Hi Jclarke,

I do not get any errors, just no information/ messages for events that occured before yesterday.

Where do I find syslog purge settings?

Screenshot attached.

Thank you,

The purge settings can be found under RME > Admin > Syslog. Make sure that when you run the syslog standard report that you have not checked the 24 hour box, and instead choose a date range that is less than your configured purge settings.

Hi Jclarke,

Checked the settings and found that they where set to the default of 7 days. I have now amended this to 180 days. Also changed the backup Policy max. file size to 1024MB.

Are these setting acceptable?

I selected upto a year prior for the Syslog report without result.

If you have any other ideas that would be good, if not we will have to take it forward from here.

Thank you,

I was finally able to open your attachments, and they look fine. I see no reason why older syslogs were not being stored except for perhaps all your daemon issues.

Moving forward, provided you have the disk space, 180 days of syslog will be fine. After 180 days, the messages will be purged from the database into your backup file. If 1 GB is sufficient to hold all of those messages, and if you have the disk space, that setting is also fine.

I would give this a bit more time now that LMS has stabilized. For example, when you come in tomorrow, run a new syslog report, and make sure you can see today's messages.

Hi Jclarke,

I have monitored for 2 days and all seems to be stable. I still can't access the historical data but we have data for the past 3 days.

I'll just cross my fingers and hope management don't want to review past reports.

Thank you again for all your help.

Max

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: