ACS 5.2 - Monitoring and Reports - No report since 23.03.2012 !

[Pierre Dubois]

Hello,

We're currently running on ACS 5.2.0.26.9 with 2 appliances (one primary and one secondary).

Today, I wanted to get some reports from the Monitoring and Reports tool. At beginning, it seemed impossible to generate them. Later, I decided to reload first primary and then secondary. As soon as I've done it, I got an email alert telling me that it failed parsing NAD.

Cisco Secure ACS -   Alarm Notification
Severity: Critical

Alarm Name	System Alarm [Collector]
Cause/Trigger	NAD parse failure
Alarm Details	Please see Collector log for   details
Generated On	Wed Apr 04 11:42:27 CEST 2012

I don't really find where I can find the Collector log...

Anyway now when I generate a 30 days report, I only get data up to 23.03.2012. Nothing recent !

Any idea why ???

Thanks,

[Pierre Dubois]

Anybody knows where I can find the Log Collector please ?

[jrabinow]

The log collector runs on the node in the deployment that is defined as the monitoring and troubleshooting node

It collects processes the log records and stores them in the monitoring and troubleshooting database

You can actually view the log file on this node by issuing the following command on the M&T node

show acs-logs filename MonitoringAndReportingCollector.log

[Pierre Dubois]

Thanks for your reply.

I use ACS as a syslog server. Could it be the reason for this error message I get ?

Log file view isn't really friendly. Is there another way to read it and to look for a specific day, date, time, ... ? Through the web interface for example ?

Thanks,

[jrabinow]

ACS is not a generic syslog server. It processes syslog records generated by ACS nodes and from some Cisco devices.

Hwoever, will not handle syslog messages from other devices.

If this is what you are trying to do this explains your error

[Pierre Dubois]

Thanks for your reply.

Yes, I was trying to use ACS as a syslog server for all of our Cisco devices.

OK. But this doesn't explain why since the 23.03.2012 no report is available ? That day, I had to shutdown the primary instance for a maintenance into the datacenter for a couple of minutes. I didn't promoted secondary into primary as it was planned as short outage. Normally, nothing special must be done when shutting down an instance. Isn't it ?

[Pierre Dubois]

Anybody has an idea why it doesn't seem to be possible to generate reports between 23.03 12h00 and 03.04.2012 ?

[Pierre Dubois]

Hello,

Any idea on my problem above ?

Moreover, when I generate report, it doesn't seem to be possible to get more than 100 pages. As it's not possible to customise the timestamp, how can I get report for a whole day ??

Thanks,