This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.
Recently detected ACS 5.4 having missing log messages and couldn't figure out what cause it. Would like to get some comment from whose ever that face this issue before.
Cisco Secure ACS - Alarm Notification
ACS - System Errors
Alarm caused by ACS - System Errors threshold
This missing log message alarm will come if logging recovery is enabled.
This logging recovery feature will be helpful in case log collector is down and ACS will try to recover those logs missed during that down time.
ACS can recover only if such messages to stored in local storage system. For example "TACACS Accounting" messages should be configured to store in local store as well. Then only Logging Recovery can recover from that ACS node.
If such messages are not available in the local store, then ACS sends alarm as "Missing log messages" and you can ignore them.
Do you think really your log collector is down for some time when you get this alarm?
Hi, no, the log collector were not down when i get this alarms.
I have checked in "Logging Categories->Global->TACACS Accounting", the box for "Log to Local Target". But NOT checked "Local Target is Critical"
ACS instances are all configured for "GLOBAL", none per-instance
Is this OK?
I have the same problem on my 5.5 platform:
CISCO SECURE ACS - ALARM NOTIFICATION
Alarm Name: ACS - System Errors
Cause/Trigger: Alarm caused by ACS - System Errors threshold
Generated on: 2015-01-29 00:22:00.0
(ACS Instance = acsdue, Time = Thu Jan 29 00:20:00 CET 2015, Category = CSCOacs_Internal_Operations_Diagnostics, Severity = ERROR, Message Text = Missing log messages)
and also the problem described in CSCuq03553. I suspect that there are some relationship between these 2 problems, maybe some log file are purged before been processed.
Any news from your site ?
Same problem with a two servers deployment using software version 5.5.
Because this message is repeated every ten minutes, I stopped the log recovery message function and message is stopped. This is a workaround.