Recently noticed an interesting thing with the Unexpected Devices syslog report: sometimes I see in there the syslog messages from the devices that are managed by RME, for instance a device's syslog messages would go into the normal syslog reports (Severity summary, 24-hour) yesterday and today I see the messages from the same device, only in the Unexpected devices report.
Maybe such devices are going between the RME managed / unmanaged states?
This would not be possible unless the device is being removed from RME (i.e. some manual intervention). Check the RME audit log under RME > Reports > Report Generator > Audit Trail to see if there are any records pertaining to this device.
Checked this log, there is nothing about the devices that show the strange behavior.
I attached a doc with the syslog fragments for a particular device that shows the problem. This device was added into the LMS about 4 months ago.
Another thought, all the devices added into DCR using the DNS names (diplay name, host name is the same and no domain defined (using the resolv.conf search)). Once a device is added and goes into the Normal state in RME, does RME query the DNS each time it receives a syslog message from that device (it should not really have to)?
SyslogAnalyzer maintains a cache of device lookups. Whenever the inventory changes for a device, the cache is invalidated. This will cause SA to look up the hostname in the message, then iterate through each interface on the devices in inventory looking for a matching IP. This whole thing can fail if the lookup on the hostname fails. This failure can be transient (as it appears to be in your case). The clear workaround is to improve resolver response time. This can be done by adding local hosts entries, or adding multiple DNS servers.
We are pleased to announce availability of Beta software for 16.6.3.
16.6.3 will be the second rebuild on the 16.6 release train targeted
towards Catalyst 9500/9400/9300/3850/3650 switching platforms. We are
looking for early feedback from customers befor...
Introduction Featured Speakers Luis Espejel is the Telecommunications
Manager of IENova, an Oil & Gas company. Currently he works with Cisco
IOS® and Cisco IOS XE platforms, and NX to some extent. He has also
worked as a Senior Engineer with the Routing P...
In this session you can learn more about Layer 3 multicast and the best
practices to identify possible threats and take security measures. It
provides an overview of basic multicast, the best security practices for
use of this technology, and recommendati...