topic Hi, no, the log collector in Network Access Control

Cisco ACS 5.4 having missing log messages error

firado1985 — Mon, 11 Mar 2019 05:03:33 GMT

Hi All,

Recently detected ACS 5.4 having missing log messages and couldn't figure out what cause it. Would like to get some comment from whose ever that face this issue before.

Cisco Secure ACS - Alarm Notification

Severity: Critical

Alarm Name

ACS - System Errors

Cause/Trigger

Alarm caused by ACS - System Errors threshold

Alarm Details

ACS Instance	Time	Category	Severity	Message Text
ACS1-PRIMARY	Thu Sep 25 06:00:01 MYT 2014	CSCOacs_Internal_Operations_Diagnostics	ERROR	Missing log messages

Report Links

ACS System Diagnostics

Generated On

2014-09-25 06:02:00.0

Hi, have you tried generate

alek.gozali — Tue, 21 Oct 2014 01:37:23 GMT

Hi,

have you tried generate some log on 2014-09-25 06:02:00.0 ?

in my case, i already seen a log TACACS Accounting, which is missing the username value,

I have the same problem on my

ALFREDO STALLONE — Fri, 06 Feb 2015 22:55:08 GMT

I have the same problem on my 5.5 platform:

CISCO SECURE ACS - ALARM NOTIFICATION

Alarm Name: ACS - System Errors

Severity: Critical

Cause/Trigger: Alarm caused by ACS - System Errors threshold

Generated on: 2015-01-29 00:22:00.0

Details

-------

(ACS Instance = acsdue, Time = Thu Jan 29 00:20:00 CET 2015, Category = CSCOacs_Internal_Operations_Diagnostics, Severity = ERROR, Message Text = Missing log messages)

and also the problem described in CSCuq03553. I suspect that there are some relationship between these 2 problems, maybe some log file are purged before been processed.

Any news from your site ?

I have had the same problem

markus-schulze — Thu, 10 Sep 2015 08:12:34 GMT

I have had the same problem on 5.6 and now on 5.7.

Has anyone an idea how to tell the system to further ignore those missing log messages ?

I have the exactly same

kelhaka — Wed, 02 Dec 2015 06:32:43 GMT

I have the exactly same problem in ACS v.5.6. I installed the latest patch 5-6-0-22-4 which I hoped could solve the problem but it didn't.

same issue here Version : 5.7

agiacometti — Wed, 04 May 2016 14:32:38 GMT

same issue here Version : 5.7.0.15.1 i've tried reboot both appliances, with no success

Hello.

andrea.meconi — Tue, 10 May 2016 13:32:13 GMT

Hello.

Same problem with a two servers deployment using software version 5.5.

Because this message is repeated every ten minutes, I stopped the log recovery message function and message is stopped. This is a workaround.

Any idea?

Thanks.

Andrea

This missing log message

radmedur — Fri, 27 May 2016 08:41:20 GMT

This missing log message alarm will come if logging recovery is enabled.

This logging recovery feature will be helpful in case log collector is down and ACS will try to recover those logs missed during that down time.

ACS can recover only if such messages to stored in local storage system. For example "TACACS Accounting" messages should be configured to store in local store as well. Then only Logging Recovery can recover from that ACS node.

If such messages are not available in the local store, then ACS sends alarm as "Missing log messages" and you can ignore them.

Do you think really your log collector is down for some time when you get this alarm?

Hi, no, the log collector

agiacometti — Fri, 27 May 2016 16:45:14 GMT

Hi, no, the log collector were not down when i get this alarms.

I have checked in "Logging Categories->Global->TACACS Accounting", the box for "Log to Local Target". But NOT checked "Local Target is Critical"

ACS instances are all configured for "GLOBAL", none per-instance

Is this OK?

Hello.

andrea.meconi — Wed, 15 Feb 2017 21:44:36 GMT

Hello.

I have the same issue with 5.8.1. Primary instance is log collector also.

Any idea?

Thanks.

Andrea

Hi.

andrea.meconi — Thu, 16 Feb 2017 10:18:52 GMT

Hi.

Please, what messages should be configured to store locally?

Thanks.

Andrea