cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
450
Views
3
Helpful
2
Replies

Syslog: Automated actions not working

I have configured syslog automated actions to send an e-mail when a specific network event occurs. This had been working fine, but for the last week, although the event happened, the e-mail was not sent. I checked to see if the actual message that would trigger the event was in /var/log/syslog_info and it was, so then I checked to see if I could see the message through RME->Report Generator->Syslog. I got no messages whatsoever from any device!!! So I stopped SyslogAnalyzer and SyslogCollector processes, restarted them and the latter problem was fixed (I now get messages from the Report Generator). I also created a network event that would trigger the existing (and once functioning) automated actions, but the action was not triggered. What else can I check???

Thanks in advance,

Katerina

2 Replies 2

Joe Clarke
Cisco Employee
Cisco Employee

You can check the AnalyzerDebug.log for errors. Since this is an email action, check the SMTP server details under Common Services > Server > Admin > System Preferences. You can also start a sniffer trace filtering on tcp/25 between the LMS server and the SMTP server, then generate a new message, and see if there are packets captured. See if there is an error in the SMTP conversation.

Hello,

it seems that the actions are working fine now. I gather that the system needed some time to get it all together, after stopping and starting the syslog services.

Thanks

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: