topic Re: syslog reports empty in Network Security https://community.cisco.com/t5/network-security/syslog-reports-empty/m-p/815929#M1032221 <HTML><HEAD></HEAD><BODY><P>The best way to troubleshoot this is to run a test while debugging syslog.</P><P></P><P>Enable debugs for syslog under RME - Admin - Preferences - Loglevel Settings</P><P></P><P>Set SyslogAnalyzer to debug</P><P></P><P>Stop SyslogCollector and SyslogAnalyzer processes (pdterm).</P><P></P><P>In the collector.properties file, set "DEBUG_LEVEL=DEBUG"</P><P></P><P>Clear the contents of the following log files:</P><P></P><P> $NMSROOT\log\SyslogCollector.log</P><P> $NMSROOT\log\SyslogAnalyzer.log</P><P> $NMSROOT\log\AnalyzerDebug.log</P><P> $NMSROOT\log\SyslogAnalyzerUI.log</P><P></P><P>Start SyslogCollector and SyslogAnalyzer processes (pdexec)</P><P></P><P>Now go a device that is managed in RME and do a conf t and exit. This should generate a config change syslog.</P><P></P><P>Make sure it hits the syslog_info and then wait a few minutes and generate a standard report for this device. Does it appear?</P><P></P><P>If not look in the 4 log files above for the device IP or hostname....what does it show?</P><P></P><P>Do the drop or invalid message counters increase?</P></BODY></HTML> Wed, 22 Aug 2007 01:19:05 GMT David Stanford 2007-08-22T01:19:05Z syslog reports empty https://community.cisco.com/t5/network-security/syslog-reports-empty/m-p/815928#M1032214 <P>Recently upgraded LMS2.5 to 2.6. Syslogs have stopped to appear in DeviceCenter/SyslogMessagesReport for all devices. Whereas it is getting logged in /var/log/syslog_info. All filter in RME/Syslog/MessageFilter disabled and changed from Drop to Keep.Restarted ciscoworks daemons.</P> Fri, 21 Feb 2020 09:39:04 GMT https://community.cisco.com/t5/network-security/syslog-reports-empty/m-p/815928#M1032214 jayarun 2020-02-21T09:39:04Z Re: syslog reports empty https://community.cisco.com/t5/network-security/syslog-reports-empty/m-p/815929#M1032221 <HTML><HEAD></HEAD><BODY><P>The best way to troubleshoot this is to run a test while debugging syslog.</P><P></P><P>Enable debugs for syslog under RME - Admin - Preferences - Loglevel Settings</P><P></P><P>Set SyslogAnalyzer to debug</P><P></P><P>Stop SyslogCollector and SyslogAnalyzer processes (pdterm).</P><P></P><P>In the collector.properties file, set "DEBUG_LEVEL=DEBUG"</P><P></P><P>Clear the contents of the following log files:</P><P></P><P> $NMSROOT\log\SyslogCollector.log</P><P> $NMSROOT\log\SyslogAnalyzer.log</P><P> $NMSROOT\log\AnalyzerDebug.log</P><P> $NMSROOT\log\SyslogAnalyzerUI.log</P><P></P><P>Start SyslogCollector and SyslogAnalyzer processes (pdexec)</P><P></P><P>Now go a device that is managed in RME and do a conf t and exit. This should generate a config change syslog.</P><P></P><P>Make sure it hits the syslog_info and then wait a few minutes and generate a standard report for this device. Does it appear?</P><P></P><P>If not look in the 4 log files above for the device IP or hostname....what does it show?</P><P></P><P>Do the drop or invalid message counters increase?</P></BODY></HTML> Wed, 22 Aug 2007 01:19:05 GMT https://community.cisco.com/t5/network-security/syslog-reports-empty/m-p/815929#M1032221 David Stanford 2007-08-22T01:19:05Z