Syslog Collector not working

Answered Question
Sep 29th, 2009
User Badges:

LMS3.2 CM3.2 RME4.3.1 on sun solaris 9


The Syslog Collector is stopped because the disk is full when i clean the disk and the space is available, I can't subscribe again and give me below message:

(

SLCA0126: Could not subscribe to the Collector.

1.Check whether the collector is running.


2.Make sure that SSL certificates are imported/exported correctly and process restarted.

3.Check whether the Certificates exported/imported are valid and have not expired.

4.Check whether SyslogAnalyzer process is running.)


I re-create certificates and stop/restart server and I port 4444 is free.

and please find below the status of syslog services:

bash-2.05# ps -ef |grep -i syslog*

root 344 1 0 Sep 26 ? 46:48 /usr/sbin/syslogd

root 452 1 0 Sep 26 ? 0:00 /usr/lib/im/htt -port 9010 -syslog -message_locale C

root 457 452 0 Sep 26 ? 0:00 htt_server -port 9010 -syslog -message_locale C

casuser 16373 8887 0 Sep 27 ? 0:20 CSCO.SyslogAnalyzer -cw /opt/CSCOpx -cw:jre lib/jre -Xms256m -Xmx256m -XX:+Heap

casuser 8940 8887 0 Sep 27 ? 0:03 CSCO.SyslogCollector -cw /opt/CSCOpx -cw:jre lib/jre -Xms64m -Xmx256m -XX:+Heap



Correct Answer by Joe Clarke about 7 years 5 months ago

You can use the /opt/CSCOpx/bin/syslogConf.pl script to change the syslog file location.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Joe Clarke Tue, 09/29/2009 - 07:08
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Make sure you restart both SyslogCollector and SyslogAnalyzer:


pdterm SyslogCollector SyslogAnalyzer

pdexec SyslogCollector SyslogAnalyzer


That should get them both synced up.

Joe Clarke Wed, 09/30/2009 - 07:05
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Post the SyslogCollector.log and AnalyzerDebug.log as well as the output of netstat -an.

Joe Clarke Fri, 10/02/2009 - 20:17
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

This is what I thought. SyslogCollector cannot read the syslog message file. By default, this file is /var/log/syslog_info. Verify the permissions on this file allow casuser to read it. Additionally, verify the perms on all parent directories allow casuser read and execute access.

albatli1977 Fri, 10/02/2009 - 20:32
User Badges:

Thanks for your quick response


I didn't find the default file of syslog but i created a new one and grant the required permission, and it's connecting with SyslogCollector,


now how i can change the default location of syslog_info

Correct Answer
Joe Clarke Fri, 10/02/2009 - 20:38
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

You can use the /opt/CSCOpx/bin/syslogConf.pl script to change the syslog file location.

Actions

This Discussion