02-24-2010 11:31 PM
I think this might be trouble:
After patching LMS 3.2 up, I checked Syslog Collector status. It *looked* fine, except every number is zero across the board. Toggling subscription on/off did nothing. I see an old thread with a similar issue that indicates TAC assistance with DB queries to fix config archive unique IDs is needed. Barring that, would I be able to recover by simply restoring a copy of the old LMS backup?
Forwarded | Invalid | Filtered | Dropped | Received | Up Time | Update Time | |||
1. | nms.fqdn.com | 0 | 0 | 0 | 0 | 0 | Feb 25 2010 02:22:00 Eastern Standard Time(GMT -05:00:00) | Feb 25 2010 02:28:49 Eastern Standard Time(GMT -05:00:00) |
tail -f SyslogAnalyzerUI.log
...
[ Wed Feb 24 18:19:38 EST 2010 ],INFO ,[TP-Processor6],com.cisco.nm.rmeng.common.VerifyRMELicense,validate,?,INFO: Resource Limit from License file=1500
[ Wed Feb 24 18:19:38 EST 2010 ],INFO ,[TP-Processor6],com.cisco.nm.rmeng.common.VerifyRMELicense,validate,?,
[ Thu Feb 25 02:10:42 EST 2010 ],ERROR,[TP-Processor1], Unable to initialize logging infrastructure for localization
[ Thu Feb 25 02:10:43 EST 2010 ],ERROR,[TP-Processor1],No resource is associated with key "Unable to initialize logging infrastructure for localization".
[ Thu Feb 25 02:10:43 EST 2010 ],ERROR,[TP-Processor1],Unable to initialize logging infrastructure for localization
I did a full dmgtd restart, but there's no new entry in SyslogAnalyzerUI.log:
02-24-2010 11:33 PM
tail -f AnalyzerDebug.log
[ Thu Feb 25 02:21:45 EST 2010 ],INFO ,[main],newsyslogqueue queue created with max size 100000
[ Thu Feb 25 02:21:45 EST 2010 ],INFO ,[main],processorsyslogqueue queue created with max size 100000
[ Thu Feb 25 02:21:45 EST 2010 ],INFO ,[main],Queue for new incoming syslogs created with size 100000
[ Thu Feb 25 02:21:45 EST 2010 ],INFO ,[main],Queue for action processor created with size 100000
[ Thu Feb 25 02:21:55 EST 2010 ],INFO ,[main],Action processors created
[ Thu Feb 25 02:21:55 EST 2010 ],INFO ,[main],Action processors created
[ Thu Feb 25 02:21:55 EST 2010 ],INFO ,[main],Action processors created
[ Thu Feb 25 02:21:55 EST 2010 ],INFO ,[main],Action processors created
[ Thu Feb 25 02:21:55 EST 2010 ],INFO ,[main],Action processors created
[ Thu Feb 25 02:22:00 EST 2010 ],INFO ,[main],Service started...
tail -f SyslogCollector.log
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:01:14,930, Logging System Initialized.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:01:14,932, System Initialized.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:01:14,962, Queue Cap 100000
SyslogCollector - [Thread: main] WARN , 25 Feb 2010 02:01:17,330, Unable to resurrect connection to a subscriber.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:01:17,376, Service started...
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:17:19,644, Logging System Initialized.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:17:19,646, System Initialized.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:17:19,666, Queue Cap 100000
SyslogCollector - [Thread: main] WARN , 25 Feb 2010 02:17:21,947, Unable to resurrect connection to a subscriber.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:17:21,993, Service started...
tail -f SyslogAnalyzerUI.log
repositories:
/WEB-INF/classes/
----------> Parent Classloader:
org.apache.catalina.loader.StandardClassLoader@170bea5
[ Wed Feb 24 18:19:38 EST 2010 ],INFO ,[TP-Processor6],com.cisco.nm.rmeng.common.VerifyRMELicense,validate,?,INFO: Resource Limit from License file=1500
[ Wed Feb 24 18:19:38 EST 2010 ],INFO ,[TP-Processor6],com.cisco.nm.rmeng.common.VerifyRMELicense,validate,?,
[ Thu Feb 25 02:10:42 EST 2010 ],ERROR,[TP-Processor1], Unable to initialize logging infrastructure for localization
[ Thu Feb 25 02:10:43 EST 2010 ],ERROR,[TP-Processor1],No resource is associated with key "Unable to initialize logging infrastructure for localization".
[ Thu Feb 25 02:10:43 EST 2010 ],ERROR,[TP-Processor1],Unable to initialize logging infrastructure for localization
02-24-2010 11:46 PM
These two appear to correspond to my manually unsubscribing the all-zero syslog collector. So my original conjecture about config archive seems bunk now, which is "good news" in its own right, but doesn't explain the zeros in SyslogCollector status.
tail -f SyslogAnalyzerUI.log
[ Thu Feb 25 02:10:42 EST 2010 ],ERROR,[TP-Processor1], Unable to initialize logging infrastructure for localization
[ Thu Feb 25 02:10:43 EST 2010 ],ERROR,[TP-Processor1],No resource is associated with key "Unable to initialize logging infrastructure for localization".
[ Thu Feb 25 02:10:43 EST 2010 ],ERROR,[TP-Processor1],Unable to initialize logging infrastructure for localization
[ Thu Feb 25 02:43:00 EST 2010 ],ERROR,[TP-Processor6], Unable to initialize logging infrastructure for localization
[ Thu Feb 25 02:43:00 EST 2010 ],ERROR,[TP-Processor6],No resource is associated with key "Unable to initialize logging infrastructure for localization".
[ Thu Feb 25 02:43:00 EST 2010 ],ERROR,[TP-Processor6],Unable to initialize logging infrastructure for localization
02-25-2010 09:53 AM
Tests have always successful from the get-go as well. Even with debug on for SyslogAnalyzer and SA UI, there's nothing revealing in the logs.
Test Collector Subscription Status | |
SSL certificate status | SSL certificates are valid and properly imported |
Collector status | Collector nms.fqdn.com is up and reachable. |
I had restored a copy of the LMS backup from this server to another. The other one has been collecting fine.
02-25-2010 10:12 AM
Finally remembered to set SyslogCollector debug in Collector.properties. It got me a clue:
SyslogCollector - [Thread: SyslogObjectForwarder] DEBUG, 25 Feb 2010 13:11:05,151, FcssSyslogObjectsForwarder - no syslogs found; returning.
SyslogCollector - [Thread: SyslogObjectForwarder] DEBUG, 25 Feb 2010 13:11:05,151, Entered zero size
02-25-2010 10:16 AM
Great, looks like somehow during the LMS 3.1 to 3.2 upgrade, SYSLOG_FILES got reset to default:
# General properties
SYSLOG_FILES=/var/log/syslog_info
DEBUG_CATEGORY_NAME=SyslogCollector
02-26-2010 10:52 AM
hi yjdabear,
do I understand you correctly that in LMS 3.1 you have changed the default syslog path but during the update the SYSLOG_FILES variable was reset to the default?
Have you changed it to the old value and now it is working again?
02-26-2010 10:54 AM
Yup, you got it all, Martin. Or, should I say "Das stimmt"?
02-26-2010 10:59 AM
So you have really earned 5 points to find this out and to jump over the 1000 mark ! :-)
...and I am sure I really need this info for the next update I plan! thanks.
02-26-2010 11:08 AM
Thanks for the points, Martin. Glad my t-shoot rambling could be useful somehow.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: