Buy or Renew
Buy or Renew
Cisco + Splunk: It’s a new day for your data. Learn more.
 
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
1230
Views
5
Helpful
9
Replies

Unable to initialize logging infrastructure for localization

yjdabear
VIP Alumni
VIP Alumni

‎02-24-2010 11:31 PM

I think this might be trouble:

After patching LMS 3.2 up, I checked Syslog Collector status. It *looked* fine, except every number is zero across the board. Toggling subscription on/off did nothing. I see an old thread with a similar issue that indicates TAC assistance with DB queries to fix config archive unique IDs is needed. Barring that, would I be able to recover by simply restoring a copy of the old LMS backup?

Forwarded Invalid Filtered Dropped Received Up Time Update Time
1.nms.fqdn.com00000Feb 25 2010 02:22:00 Eastern Standard Time(GMT -05:00:00)Feb 25 2010 02:28:49 Eastern Standard Time(GMT -05:00:00)

tail -f SyslogAnalyzerUI.log

...

[ Wed Feb 24  18:19:38 EST 2010 ],INFO ,[TP-Processor6],com.cisco.nm.rmeng.common.VerifyRMELicense,validate,?,INFO: Resource Limit from License file=1500
[ Wed Feb 24  18:19:38 EST 2010 ],INFO ,[TP-Processor6],com.cisco.nm.rmeng.common.VerifyRMELicense,validate,?,
[ Thu Feb 25  02:10:42 EST 2010 ],ERROR,[TP-Processor1], Unable to initialize logging infrastructure for localization
[ Thu Feb 25  02:10:43 EST 2010 ],ERROR,[TP-Processor1],No resource is associated with key "Unable to initialize logging infrastructure for localization".
[ Thu Feb 25  02:10:43 EST 2010 ],ERROR,[TP-Processor1],Unable to initialize logging infrastructure for localization

I did a full dmgtd restart, but there's no new entry in SyslogAnalyzerUI.log:

Labels:
0 Helpful
9 Replies 9

yjdabear
VIP Alumni
VIP Alumni

‎02-24-2010 11:33 PM

tail -f AnalyzerDebug.log

[ Thu Feb 25  02:21:45 EST 2010 ],INFO ,[main],newsyslogqueue queue created with max size 100000

[ Thu Feb 25  02:21:45 EST 2010 ],INFO ,[main],processorsyslogqueue queue created with max size 100000

[ Thu Feb 25  02:21:45 EST 2010 ],INFO ,[main],Queue for new incoming syslogs created with size 100000

[ Thu Feb 25  02:21:45 EST 2010 ],INFO ,[main],Queue for action processor created with size 100000

[ Thu Feb 25  02:21:55 EST 2010 ],INFO ,[main],Action processors created

[ Thu Feb 25  02:21:55 EST 2010 ],INFO ,[main],Action processors created

[ Thu Feb 25  02:21:55 EST 2010 ],INFO ,[main],Action processors created

[ Thu Feb 25  02:21:55 EST 2010 ],INFO ,[main],Action processors created

[ Thu Feb 25  02:21:55 EST 2010 ],INFO ,[main],Action processors created

[ Thu Feb 25  02:22:00 EST 2010 ],INFO ,[main],Service started...

tail -f SyslogCollector.log
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:01:14,930, Logging System Initialized.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:01:14,932, System Initialized.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:01:14,962, Queue Cap 100000
SyslogCollector - [Thread: main] WARN , 25 Feb 2010 02:01:17,330, Unable to resurrect connection to a subscriber.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:01:17,376, Service started...
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:17:19,644, Logging System Initialized.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:17:19,646, System Initialized.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:17:19,666, Queue Cap 100000
SyslogCollector - [Thread: main] WARN , 25 Feb 2010 02:17:21,947, Unable to resurrect connection to a subscriber.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:17:21,993, Service started...

tail -f SyslogAnalyzerUI.log
  repositories:
    /WEB-INF/classes/
----------> Parent Classloader:
org.apache.catalina.loader.StandardClassLoader@170bea5

[ Wed Feb 24  18:19:38 EST 2010 ],INFO ,[TP-Processor6],com.cisco.nm.rmeng.common.VerifyRMELicense,validate,?,INFO: Resource Limit from License file=1500
[ Wed Feb 24  18:19:38 EST 2010 ],INFO ,[TP-Processor6],com.cisco.nm.rmeng.common.VerifyRMELicense,validate,?,
[ Thu Feb 25  02:10:42 EST 2010 ],ERROR,[TP-Processor1], Unable to initialize logging infrastructure for localization
[ Thu Feb 25  02:10:43 EST 2010 ],ERROR,[TP-Processor1],No resource is associated with key "Unable to initialize logging infrastructure for localization".
[ Thu Feb 25  02:10:43 EST 2010 ],ERROR,[TP-Processor1],Unable to initialize logging infrastructure for localization

0 Helpful

yjdabear
VIP Alumni
VIP Alumni
In response to yjdabear

‎02-24-2010 11:46 PM

These two appear to correspond to my manually unsubscribing the all-zero syslog collector. So my original conjecture about config archive seems bunk now, which is "good news" in its own right, but doesn't explain the zeros in SyslogCollector status.

tail -f SyslogAnalyzerUI.log

[ Thu Feb 25  02:10:42 EST 2010 ],ERROR,[TP-Processor1], Unable to initialize logging infrastructure for localization
[ Thu Feb 25  02:10:43 EST 2010 ],ERROR,[TP-Processor1],No resource is associated with key "Unable to initialize logging infrastructure for localization".
[ Thu Feb 25  02:10:43 EST 2010 ],ERROR,[TP-Processor1],Unable to initialize logging infrastructure for localization
[ Thu Feb 25  02:43:00 EST 2010 ],ERROR,[TP-Processor6], Unable to initialize logging infrastructure for localization
[ Thu Feb 25  02:43:00 EST 2010 ],ERROR,[TP-Processor6],No resource is associated with key "Unable to initialize logging infrastructure for localization".
[ Thu Feb 25  02:43:00 EST 2010 ],ERROR,[TP-Processor6],Unable to initialize logging infrastructure for localization

0 Helpful

yjdabear
VIP Alumni
VIP Alumni
In response to yjdabear

‎02-25-2010 09:53 AM

Tests have always successful from the get-go as well. Even with debug on for SyslogAnalyzer and SA UI, there's nothing revealing in the logs.

Test Collector Subscription Status
SSL certificate status SSL certificates are valid and properly imported
Collector status Collector nms.fqdn.com is up and reachable.

I had restored a copy of the LMS backup from this server to another. The other one has been collecting fine.

0 Helpful

yjdabear
VIP Alumni
VIP Alumni

‎02-25-2010 10:12 AM

Finally remembered to set SyslogCollector debug in Collector.properties. It got me a clue:

SyslogCollector - [Thread: SyslogObjectForwarder] DEBUG, 25 Feb 2010 13:11:05,151, FcssSyslogObjectsForwarder - no syslogs found; returning.
SyslogCollector - [Thread: SyslogObjectForwarder] DEBUG, 25 Feb 2010 13:11:05,151, Entered zero size

0 Helpful

yjdabear
VIP Alumni
VIP Alumni
In response to yjdabear

‎02-25-2010 10:16 AM

Great, looks like somehow during the LMS 3.1 to 3.2 upgrade, SYSLOG_FILES got reset to default:

# General properties
SYSLOG_FILES=/var/log/syslog_info
DEBUG_CATEGORY_NAME=SyslogCollector

Martin Ermel
VIP Alumni
VIP Alumni
In response to yjdabear

‎02-26-2010 10:52 AM

hi yjdabear,

do I understand you correctly that in LMS 3.1 you have changed the default syslog path but during the update the SYSLOG_FILES variable was reset to the default?

Have you changed it to the old value and now it is working again?

0 Helpful

yjdabear
VIP Alumni
VIP Alumni
In response to Martin Ermel

‎02-26-2010 10:54 AM

Yup, you got it all, Martin. Or, should I say "Das stimmt"?

0 Helpful

Martin Ermel
VIP Alumni
VIP Alumni
In response to yjdabear

‎02-26-2010 10:59 AM

So you have really earned 5 points to find this out and to jump over the 1000 mark ! :-)

...and I am sure I really need this info for the next update I plan! thanks.

0 Helpful

yjdabear
VIP Alumni
VIP Alumni
In response to Martin Ermel

‎02-26-2010 11:08 AM

Thanks for the points, Martin. Glad my t-shoot rambling could be useful somehow.

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents