Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Attention: The Community will be in read-only mode on 12/14/2017 from 12:00 am pacific to 11:30 am.

During this time you will only be able to see content. Other interactions such as posting, replying to questions, or marking content as helpful will be disabled for few hours.

We apologize for the inconvenience while we perform important updates to the Community.

New Member

RME 4.1 Syslog Report

Hi,

What is the maximum number of records that can be displayed on the syslog report ?

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: RME 4.1 Syslog Report

I re-read your second post, and I think I misunderstood what you were doing. If you have a custom report template, and you've specified a specific mnemonic on which to search, the search is done by creating an SQL query which specifies the custom report parameters (i.e. the mnemonic in this case) along with the device ID(s) selected for the search. Since the syslog messages are divided up into multiple tables in the RME database (based on date), the SQL query is split into multiple queries with each running on a specific table. For each table queried, the results are added to the overall result set. Once that result set reaches the 10,000 message limit, no further queries are performed.

9 REPLIES
Cisco Employee

Re: RME 4.1 Syslog Report

There is a limit to displaying 10,000 messages. However, an unlimited number of messages can be exported.

New Member

Re: RME 4.1 Syslog Report

Hi jclarke,

Thanks for your quick response.

May I know where can I find the information about this ?

If I filter the messages that is displayed in the report ( e.g. only display certain Mnemonic ),

Which data does the 10,000 limit will be applied on, the filtered data or the original data ?

I'm facing an issue displaying a full month syslog report.

The report is meant to display certain Mnemonics only.

When I run the report generator for a whole month, I only get the last half month report, where the first half month is not displayed.

However if I run the daily report from the 1st day of the month, it can be displayed without any problem.

Any help would be appreciated.

Thanks

Cisco Employee

Re: RME 4.1 Syslog Report

There is a bug in your version of RME where the data displayed is unsorted. It commonly shows the oldest data first. The bug is CSCsz32320. I fixed it so that the latest messages are shown first up to the first 10,000. The sort is applied to the filtered data.

Cisco Employee

Re: RME 4.1 Syslog Report

I re-read your second post, and I think I misunderstood what you were doing. If you have a custom report template, and you've specified a specific mnemonic on which to search, the search is done by creating an SQL query which specifies the custom report parameters (i.e. the mnemonic in this case) along with the device ID(s) selected for the search. Since the syslog messages are divided up into multiple tables in the RME database (based on date), the SQL query is split into multiple queries with each running on a specific table. For each table queried, the results are added to the overall result set. Once that result set reaches the 10,000 message limit, no further queries are performed.

New Member

Re: RME 4.1 Syslog Report

Since the limit 10,000 is based on the overall result set(CMIIW). I believe this is not the case. Since the last half month showed in the report has only <1,000 records.

Any clue to find the root cause of this issue ?

Thanks

Cisco Employee

Re: RME 4.1 Syslog Report

Are you hitting the max of 10,000 messages in the displayed output?

New Member

Re: RME 4.1 Syslog Report

No, the displayed output is only 967 records.

Cisco Employee

Re: RME 4.1 Syslog Report

Post a screenshot of the report you are running showing all of the parameters in addition to the SyslogAnalyzerUI.log.

New Member

Re: RME 4.1 Syslog Report

Found the issue already. The data has been purged. Thus there is no data from the first half month.

There was a miss communication with the person at the site.

The daily report that he was referring to is the report that has been generated daily.

Thanks for your clarification and the helpful explanation.

162
Views
0
Helpful
9
Replies
CreatePlease to create content