cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
738
Views
0
Helpful
9
Replies

RME 4.1 Syslog Report

chronix
Level 1
Level 1

Hi,

What is the maximum number of records that can be displayed on the syslog report ?

1 Accepted Solution

Accepted Solutions

I re-read your second post, and I think I misunderstood what you were doing. If you have a custom report template, and you've specified a specific mnemonic on which to search, the search is done by creating an SQL query which specifies the custom report parameters (i.e. the mnemonic in this case) along with the device ID(s) selected for the search. Since the syslog messages are divided up into multiple tables in the RME database (based on date), the SQL query is split into multiple queries with each running on a specific table. For each table queried, the results are added to the overall result set. Once that result set reaches the 10,000 message limit, no further queries are performed.

View solution in original post

9 Replies 9

Joe Clarke
Cisco Employee
Cisco Employee

There is a limit to displaying 10,000 messages. However, an unlimited number of messages can be exported.

Hi jclarke,

Thanks for your quick response.

May I know where can I find the information about this ?

If I filter the messages that is displayed in the report ( e.g. only display certain Mnemonic ),

Which data does the 10,000 limit will be applied on, the filtered data or the original data ?

I'm facing an issue displaying a full month syslog report.

The report is meant to display certain Mnemonics only.

When I run the report generator for a whole month, I only get the last half month report, where the first half month is not displayed.

However if I run the daily report from the 1st day of the month, it can be displayed without any problem.

Any help would be appreciated.

Thanks

There is a bug in your version of RME where the data displayed is unsorted. It commonly shows the oldest data first. The bug is CSCsz32320. I fixed it so that the latest messages are shown first up to the first 10,000. The sort is applied to the filtered data.

I re-read your second post, and I think I misunderstood what you were doing. If you have a custom report template, and you've specified a specific mnemonic on which to search, the search is done by creating an SQL query which specifies the custom report parameters (i.e. the mnemonic in this case) along with the device ID(s) selected for the search. Since the syslog messages are divided up into multiple tables in the RME database (based on date), the SQL query is split into multiple queries with each running on a specific table. For each table queried, the results are added to the overall result set. Once that result set reaches the 10,000 message limit, no further queries are performed.

Since the limit 10,000 is based on the overall result set(CMIIW). I believe this is not the case. Since the last half month showed in the report has only <1,000 records.

Any clue to find the root cause of this issue ?

Thanks

Are you hitting the max of 10,000 messages in the displayed output?

No, the displayed output is only 967 records.

Post a screenshot of the report you are running showing all of the parameters in addition to the SyslogAnalyzerUI.log.

Found the issue already. The data has been purged. Thus there is no data from the first half month.

There was a miss communication with the person at the site.

The daily report that he was referring to is the report that has been generated daily.

Thanks for your clarification and the helpful explanation.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: