The version that is running is the RME 4.0.4, i don't have access now on the machine but i see everything in the syslog.log.

I will still need a sample message from the syslog.log file. It would also help to get a screenshot of the Syslog Collector stats page in LMS.

Hi,

I added some info in attachment.

Hi Peter,

try the following:

"RME -> Reports -> Costum Report Template"

Create a new entry and in the next window choos "syslog". Proceed with "next" and enter a name for this new report in "Custom Report Name:". make it accessible for public anf press the button "Add".

enter the following values in the new window:

Facility: DOT1X

Sub-Facility: *

Severity: 4

Mnemonic: MAXRETRIES

Description: *

Then click on Save and in the last window press the button "Finish".

Then you can select this report in the report generator.

It should also gives you results in the 24-hour report.

Attention: I have not tested this with the actual 2.6. In previous versions i was not able to extract older syslogs or events. The syslog report can show you the entries from the time you setup the costum report. Not recognizing the entries before that time!

I hope that helps!

Best regards,

Frank

Check your syslog filters page in RME as well (RME > Tools > Syslog > Message Filters). Make sure these messages are not filtered out. This can happen if you accidentally change the filter mode from Drop to Keep.

Next, check the syslog unexpected device report to see if the messages are showing up there instead of the standard reports.

Finally, there may be an issue with the timezone format, "CET+1". You might need to enable SyslogAnalyzer debugging under RME > Admin > System Preferences > Loglevel Settings, and check the AnalyzerDebug.log to see if those messages are being ignored.

Sorry for the late response but i was not able to reply. I must say that i struggle still with the problem. I added the info of the debug in att.

Hi Peter,

maybe you will find some application errors in the syslog.log.

The output from your attachment seems to show an error with the insertion of the syslog message into the database.

Try the following:

- in Program Files\CSCOpx\setup\support you will find the resetcasuser.exe. Execute it and restart the daemon manager. If your last server restart is some weeks ago so have a complete restart of the machine.

- reset the rme database:

Open a DOS shell and issue the command:

net stop crmdmgtd

Once you get the prompt back, open up the task manager and go to processes.

If any of these processes are listed, kill them manually:

sm_server

sm_authority

brstart

Now, go to CSCOpx\bin and issue the commands (case sensitive):

perl dbRestoreOrig.pl dsn=rmeng dmprefix=RME

To re-start the CiscoWorks application:

net start crmdmgtd

Wait 5-10 minutes and login to CiscoWorks

Best regards,

Frank

Hello,

The last reply solved my problem, but thanks to all who have helped me to solve the problem.

Peter

Hello Frank,

The problem is solved by the reset of the RME Database.

Kind Regards,

Peter

Hi Jclarke,

I too had the same problem which was reported by PETER, and I applied your solution (Which is mentioned below) and it works fine, only extra thing which I did was restarted ciscoworks server, after around 5 to 8 minutes I am finding all the syslog messages but all are new ones.

("Check your syslog filters page in RME as well (RME > Tools > Syslog > Message Filters). Make sure these messages are not filtered out. This can happen if you accidentally change the filter mode from Drop to Keep.")

Best Regards,

Arif