WAE error in log %WAAS-UMKNOWN-1-899999

[Keith Nelson]

Hello. Been chasing this WAE log error for a long time. It's a password user unknown error. Is there an easy way to determine where the unknown user is sourcing from? I'm assuming this is a SNMP query or something? Hoping the 899999 code means something to you. This is on a WAE-612-k9 running 4.4.3.

Thanks,

-Keith

Sent from Cisco Technical Support iPad App

[Keith Nelson]

After reading some previous discussions, I've found that the login attempts are from our Cisco Works. It's filling my WAE logs, so we need to tell Cisco Works not to try and manage the WAAS devices.

I went to the device and did a #find match "unknown" syslog.txt

and the username and from was enumerated. Couldn't see that level of info from the CM logs.

-Keith

Sent from Cisco Technical Support iPad App

[Bhavin Yadav]

Hi Keith,

CM will not log error messages for WAEs. It will rather log messages for itself. This is for CM CLI logs. CM GUI will show you alarms for all the WAEs.

Regards.

[Patrick Moubarak · Accepted solution]

Hi Bhavin,

I think you can see some of the logs of WAE devices in the CM GUI:

My WAN --> Admin --> Logs --> System Messages

This should contain the syslog messages of WAE accelerators. You can set WAEs to record syslog messages to the disk in /local1/syslog.txt file or send to an external syslog server...

There are more detailed and more specific logs (per AO) in the disk of each WAE in /local1/errorlog/... those are not forwarded by syslog as far as I know; I guess you can write scripts to go get them by FTP

Patrick

[Bhavin Yadav]

That's right, Patrick. May be I was not very clear on my message. You will see logs thru CM GUI but not on CM CLI as the CLI logs are specific to CM only.

Regards.