Syslog problems LMS2.5

Answered Question
Oct 11th, 2006
User Badges:

I have the following problem when i want to view a report of the syslog in CW2K i don't see anything (no records found), when i go in the file syslog.log i see the capture of the syslog messages, how can i solve this problem

Correct Answer by frankzehrer about 10 years 9 months ago

Hi Peter,


i am glad to hear it is working. What helped? The casuser reset odr the reseto of RME Database?


Best regards,


Frank


P.S. Please rate helpful posts

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.3 (7 ratings)
Loading.
Joe Clarke Wed, 10/11/2006 - 07:37
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

What version of RME do you have? Please provide a sample log message that is not being shown in the reports?

pbogaerts Thu, 10/12/2006 - 23:01
User Badges:

The version that is running is the RME 4.0.4, i don't have access now on the machine but i see everything in the syslog.log.

Joe Clarke Fri, 10/13/2006 - 09:05
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

I will still need a sample message from the syslog.log file. It would also help to get a screenshot of the Syslog Collector stats page in LMS.

frankzehrer Sun, 10/22/2006 - 23:46
User Badges:
  • Silver, 250 points or more

Hi Peter,


try the following:

"RME -> Reports -> Costum Report Template"

Create a new entry and in the next window choos "syslog". Proceed with "next" and enter a name for this new report in "Custom Report Name:". make it accessible for public anf press the button "Add".

enter the following values in the new window:

Facility: DOT1X

Sub-Facility: *

Severity: 4

Mnemonic: MAXRETRIES

Description: *


Then click on Save and in the last window press the button "Finish".


Then you can select this report in the report generator.

It should also gives you results in the 24-hour report.


Attention: I have not tested this with the actual 2.6. In previous versions i was not able to extract older syslogs or events. The syslog report can show you the entries from the time you setup the costum report. Not recognizing the entries before that time!


I hope that helps!


Best regards,

Frank

Joe Clarke Mon, 10/23/2006 - 08:18
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Check your syslog filters page in RME as well (RME > Tools > Syslog > Message Filters). Make sure these messages are not filtered out. This can happen if you accidentally change the filter mode from Drop to Keep.


Next, check the syslog unexpected device report to see if the messages are showing up there instead of the standard reports.


Finally, there may be an issue with the timezone format, "CET+1". You might need to enable SyslogAnalyzer debugging under RME > Admin > System Preferences > Loglevel Settings, and check the AnalyzerDebug.log to see if those messages are being ignored.

pbogaerts Wed, 11/08/2006 - 03:44
User Badges:

Sorry for the late response but i was not able to reply. I must say that i struggle still with the problem. I added the info of the debug in att.



Attachment: 
frankzehrer Wed, 11/08/2006 - 06:37
User Badges:
  • Silver, 250 points or more

Hi Peter,


maybe you will find some application errors in the syslog.log.


The output from your attachment seems to show an error with the insertion of the syslog message into the database.


Try the following:


- in Program Files\CSCOpx\setup\support you will find the resetcasuser.exe. Execute it and restart the daemon manager. If your last server restart is some weeks ago so have a complete restart of the machine.




- reset the rme database:

Open a DOS shell and issue the command:

net stop crmdmgtd


Once you get the prompt back, open up the task manager and go to processes.

If any of these processes are listed, kill them manually:

sm_server

sm_authority

brstart


Now, go to CSCOpx\bin and issue the commands (case sensitive):

perl dbRestoreOrig.pl dsn=rmeng dmprefix=RME


To re-start the CiscoWorks application:

net start crmdmgtd


Wait 5-10 minutes and login to CiscoWorks


Best regards,

Frank

pbogaerts Thu, 11/09/2006 - 05:02
User Badges:

Hello,


The last reply solved my problem, but thanks to all who have helped me to solve the problem.


Peter

Correct Answer
frankzehrer Thu, 11/09/2006 - 06:39
User Badges:
  • Silver, 250 points or more

Hi Peter,


i am glad to hear it is working. What helped? The casuser reset odr the reseto of RME Database?


Best regards,


Frank


P.S. Please rate helpful posts

pbogaerts Fri, 11/24/2006 - 00:43
User Badges:

Hello Frank,


The problem is solved by the reset of the RME Database.


Kind Regards,


Peter

arifkhan Mon, 11/27/2006 - 04:33
User Badges:

Hi Jclarke,


I too had the same problem which was reported by PETER, and I applied your solution (Which is mentioned below) and it works fine, only extra thing which I did was restarted ciscoworks server, after around 5 to 8 minutes I am finding all the syslog messages but all are new ones.


("Check your syslog filters page in RME as well (RME > Tools > Syslog > Message Filters). Make sure these messages are not filtered out. This can happen if you accidentally change the filter mode from Drop to Keep.")


Best Regards,

Arif

Actions

This Discussion