Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

LMS syslog


Our syslog stopped working and we fixed it by collector and analyzer restart.

But I noticed that the new syslog report does not have the syslog information for the last two days.

Does the syslog starts working again, will it not collect the information from where it stopped last from syslog.log.

Is there any other possiblities and issue which can cause this?

Is there a way I can force syslog to pick those entries from syslog.log for missing 1 or 2 days after collector and analyzer restart?

As it has happened twice.

Please advice.


Cisco Employee

Re: LMS syslog

No, SyslogCollector will not read only messages from the syslog log when it starts. It will simply start reading from the end of the file.

You can force it to read the messages, though. Stop SyslogCollector and Analyzer. Extract all the messages you wish to resubmit from the syslog log file. Clear out the syslog log file. Restart SyslogCollector and Analyzer. Then append the messages to the syslog log file. Something like:

NET STOP crmlog

TYPE newsyslogs.txt >> syslog.log

NET START crmlog

Should work under Windows. On Solaris, you can just do the append without restarting the syslogd:

cat newsyslogs.txt >> /var/log/syslog_info

Note: you may have to split the messages up so no more than 200 are written to the syslog log at one time.

New Member

Re: LMS syslog

Thanks jclarke,

I just want to clear at last is, if the syslog service in RME somehow stops working and it again starts it will not pick the old syslog mesaged from the syslog file, but it will start taking the new logs entered after the syslog service started again?

Please advise.


Cisco Employee

Re: LMS syslog

This is correct.