Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

CW LMS v2.6 syslog issue. I am receiving syslog records to the collector but they are not getting forwarded to the syslog analyzer.

When I look at the syslogcollector.log file it is telling me it cannot find the following file -

SyslogCollector - [Thread: Thread-13] WARN , 18 Aug 2010 16:07:10,804, Unable to add monitor for usmelas039
NMSROOT is D:/PROGRA~1/CSCOpx
propFileD:/PROGRA~1/CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\D:\PROGRA~1\CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties
Unable to find the file D:/PROGRA~1/CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\D:\PROGRA~1\CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties
NMSROOT is D:/PROGRA~1/CSCOpx
propFileD:/PROGRA~1/CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\csc\data\Collector.properties

I noticed that the NMSROOT is d:/program~..., shouldn't it be d:\program~...

I do have the file.

What should I do to resolve this.  I have unsubscribed and resubscribed.  I look at status and I see syslog records getting to the syslog.log file and getting filtered but no records being forwarded.

Help.

I have attached syslogcollector.log file.

also attached the collector.properties file.

Message was edited by: j.goff I attached the netstat.txt file.  From the command you sent there is no -o or -b option so I just ran it with -an.

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: CW LMS v2.6 syslog issue. I am receiving syslog records to t

The problem is you are dropping all the syslogs.  If you look at the collector status, you will see almost all of your syslogs are under the "Filtered" count.  You need to set the sylogs to "Keep" and then you will start seeing counts under the "Forwarded" category.  If all filters are disabled with Keep selected, that means ALL syslogs will be processed.  So you should enable some general filters and set it to Keep.  This way, it will only keep the syslogs specified in your filters and not ALL of them.

Message was edited by: Joel Monge

5 REPLIES
Cisco Employee

Re: CW LMS v2.6 syslog issue. I am receiving syslog records to t

The path is correct.  Seems like something could be bound to the SyslogAnalyzer port.  First, make sure you are on RME 4.0.6 (want to avoid CSCsh66475).  If so, shutdown daemons (net stop crmdmgtd) and post the following file from your C drive:

netstat -anob > C:\netstat.txt
Cisco Employee

Re: CW LMS v2.6 syslog issue. I am receiving syslog records to t

This looks fine.  Was the hostname recently changed?  Was this working before, did anything change?  What RME version are you on?  Post a screenshot of your filters and the syslog collector status.

New Member

Re: CW LMS v2.6 syslog issue. I am receiving syslog records to t

No the hostname was not changed.  This worked for years.  Around June 2010 is when I noticed I was not getting any records in my syslog reports.  Took two months to get around to finding a resolution with no success.

The RME version is 4.0.6.

I am attaching screen shots.

Cisco Employee

Re: CW LMS v2.6 syslog issue. I am receiving syslog records to t

The problem is you are dropping all the syslogs.  If you look at the collector status, you will see almost all of your syslogs are under the "Filtered" count.  You need to set the sylogs to "Keep" and then you will start seeing counts under the "Forwarded" category.  If all filters are disabled with Keep selected, that means ALL syslogs will be processed.  So you should enable some general filters and set it to Keep.  This way, it will only keep the syslogs specified in your filters and not ALL of them.

Message was edited by: Joel Monge

New Member

Re: CW LMS v2.6 syslog issue. I am receiving syslog records to t

Thank you so much.  Man oh man was that too simple or what.  Thanks again.

I am now getting records forwarded.

351
Views
0
Helpful
5
Replies