×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

LMS 3.2 syslog connection refused

Unanswered Question
Mar 27th, 2012
User Badges:

Hi,

I get the following error:


SyslogCollector - [Thread: SyslogObjectForwarder] ERROR, 27 Mar 2012 09:02:12,254, Could not send syslogs, removing the subscriber...Connection refused: connect

SyslogCollector - [Thread: SyslogObjectForwarder] ERROR, 27 Mar 2012 09:03:15,223, Could not send syslogs, removing the subscriber...Connection refused: connect


Syslog subscription seems ok but syslog messages are dropped and not forwarded:


SHOT1479.jpg


I attached SyslogCollector.log, SyslogAnalyzer.log, AnalyzerDebug.log


Tnaks

Attachment: 
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.7 (4 ratings)
Loading.
Vinod Arya Tue, 03/27/2012 - 02:32
User Badges:
  • Cisco Employee,

HI,


Ignore these error messages as these comes often. What is important to note is if the Collector is subscibed properly.


What is important to check is if the counters are incrementing even if Filetered or Dropped and see for Received as well.


if so, please make sre your Filters are configured properly as only due to filter the Syslog message are not forwarded. Check different combinations which work, following is the way they work :


-If you DISABLE all the filters and have the filter type as KEEP, then all the syslog messages are processed (kept).

-If you DISABLE all the filters and have the filter type as DROP, then all the syslog messages are dropped. No filtering is done but everything will be dropped.

-If you ENABLE all the filters and have the filter type as KEEP, then all the syslog messages that match the filter criteria are processed.

-If you ENABLE all the filters and have the filter type as DROP, then all the syslog messages that match the filter criteria are dropped.


Check mine for example :



-Thanks

Vinod

Wassim Aouadi Tue, 03/27/2012 - 06:25
User Badges:

Thanks Vinod for the explanation.

I restarted CiscoWorks process with "net stop crmdmgtd" and "net start crmdmgtd" and syslog are now forwarded correctly.

Vinod Arya Tue, 03/27/2012 - 06:49
User Badges:
  • Cisco Employee,

Hi Wass,


This is great news. Though in future if the processes requires restart you may just want to restart the Syslog processes first to save time and reduce application downtime.


Most essesntial processes are SyslogAnalyzer and SyslogCollector. You can use the command pdterm to stop and pdexec to start the process.


example :

pdterm SyslogAnalyzer

pdterm SyslogCollector


pdexec SyslogAnalyzer

pdexec SyslogCollector


For a small detail on Syslog i have prepared one image whcih you can check for refrence.


-Thanks

Vinod

Actions

This Discussion

Related Content