We recieved several alerts last night from our publisher referring the to CAR Web service being down. Upon further investigation RTMT wouldn't connect, and the web interface for administration was fine. All phones register to the subscribers in the cluster so no call processing was affected. We rebooted the publisher and the alerts have gone away and all services appear to be running fine. I can see CDR records getting pushed to our Billing Server. The one thing that appears to be different is the CiscoSyslogSubA service. This service is running @ 25% on the publisher, all other nodes are running @ 0 %. Could this be what caused the original issue or is this the server trying to do some catch up. The service has been @ this state for almost 12 hours.