Ciscoworks not storing device SYSLOG messages.

[jrichterkessing]

CiscoWorks is not storing any of my devices SYSLOG information. According to the syslog_info file, the last log was stored on DEC22, 2005. Here is what I have done so far:

1. Deleted the syslog_info file, reloaded CiscoWorks and verified that the devices have logging turned on and are configured to send to the CiscoWorks server. My assumption is that if the file was deleted, a new one would be created, since that didn't work, I created a syslog_info file that was "blank".

2. Under "RME|Administration|Syslog Analysis|Syslog Collector Status" I receive "Error in accessing server's database." Recommended Action: "Select Server Configuration>Administration>Process Management>Process Status to verify that the EssentialsDbEngine is running, and retry".....I checked and the EssentialsDbEngine is running.

3. I checked the syslog.conf file in /etc and the local7.info line is set to /var/log/syslog_info as it should be (there aren't any other local7.info lines/sections in the file).

I am running RME v3.5.

I can't find any changes on Dec22 that would have impacted this in any way, so I don't know why it just stopped logging.

Thank you in advance for any help...Jeff

[nhabib]

If the messages are not making it to the syslog_info file, then RME will be unable to display them.

However, this is not an RME issue. This is a Solaris or network issue.

First thing you should do is check and see if the messages are making it to the Solaris box by setting up a snoop trace.

[jrichterkessing]

Thanks....I was kind of afraid of that. I know next to nothing about Solaris. A packet trace is a good idea, I'll make sure the logs are destined for the Solaris box.....just need to find someone here who knows more about Solaris. Thanks again...Jeff

[yjdabear]

If syslogs are hitting the server, then check if your syslog server process is running. On Solaris: ps -ef | grep syslogd

[mszoke]

I too am having recent difficulties with Syslog. Things seemed to have stopped working lately.

[nickmaiolo]

Im running into the same problem. I have several installations of LMS 2.5.1 on a Solaris 9 platform. 2 out of the 4 boxes, the syslog_info file just stopped being updated. Ive completely formatted the one box and its back up and running now, but the other is in a bad way still.

Is there some paper that goes into detail about how the syslog process works on a Solaris installation?

I mean, the bits i can see are :

switch.syslog --> /var/log/syslog_info

CiscoWorks reads this file and copies into its own database.

Where is this? How does it do it? Is there a config file i can check? Some known bug?

etc etc

Thanks