Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Support Tools UCC Enterprise

I have installed the Support Tools version This is running in a UCCE 7.2 environment. Everything seems to be working with exception for the "Event Detection and Alerts". I have verified SMTP from the support tools server. Is there a way for me to verify the SNMP from both client servers and the support tools server?


Re: Support Tools UCC Enterprise

That's for the SysLog feed - not SNMP.

Are you seeing the SysLog files appear on your Support Tools interface?

Have you configured the cw2kfeed on your Loggers.



New Member

Re: Support Tools UCC Enterprise

Thanks Geoff.

I found the "SysLog Destinations" in the Cisco SNMP Agent Management on the Loggers. This seems pretty straight foward to setup. However, I cannot find the similar tool on the Support Tools server. Is this simply configured on install of the Support Tools software?

Can you point me to any documentation for this setup? I cannot find it on


Re: Support Tools UCC Enterprise

You don't have to set up anything on the Support Tools server. It has a syslog receiver listening on the standard port of 514. If you look at the page on configuring alerts, you will see port 514 mentioned there as the port it's listening on.

From page 67 of the Support Tools Guide for 2.3(1):

"The Support Tools Application Server collects and logs 'syslog' messages and alerts an administrator through email when a critical event is detected. This feature is not installed on the Node Agent.

The Event Detection and Alerting tool runs automatically as part of the Application Server and is enabled by default. It can be enabled or disabled by the administrator from the Event Detectionand Alert menu. 'Syslog' messages sent to the configurable port from any source are logged without modification in the order received to a file in the repository."

Even if you don't have any alerts configured, you should see the syslogs appear on the appropriate page.

There appeared to me to be a bug in 7.2 for the cw2kfeed on the Logger that was resolved by SR3.

The cw2kfeed configuration is stored in the registry under ICM\\LoggerA - check that CW2KFeedEnabled = 1 and CW2KFeedServerName is the IP address of your Support Tools server.

That address is not the only place - more critical is ICM\\LoggerA\NodeManager\CurrentVersion\Processes\cw2kfeed\ImageArgs which provides the starting arguments to the cw2kfeed process.

Ensure that this is /server /port 514 /pipe CSFSEventFeed /QSize 100.

Prior to the application of the SR, the number 100 for QSize was a funny character that prevented the feed from working correctly.