Logs are lost frequently in Remote Agent Server

[Prasan Venky]

Hi All,

ACS 4.2 and remote agent was working properly two months before. But in past two months we are facing weird issue in RA server.For Somedays we are missing logs from both ACS and RA server. Once we notice this we use to restart the services in ACS to give workaround. But due to this we loose our daily logs intermittently and facing risk in without having logs.

This is not like communication between ACS and RA is not at all happening. It happens properly for a week or month, but again it is going bad without any config change.

CSAgent.ini file is properly configured.

Full version is 4.2.1.15 and patch is 10 in acs and ra.

ACS and Remote Agent Major and Patch version are same.

Any help would be highly appreciated.

Thanks.

[Jatin Katyal]

Are you only facing issues with remote logging or with windows authentication as well.

Please set the logging level to FULL on the ACS appliance, wait for the issue to reoccur/ trigger again.

Once done, download the package.cab file from ACS.

Grab the cslogagent file from the remote agent server.

C:\Program Files\Cisco\CiscoSecure ACS Agent\CSLogAgent\Logs

Do provide the MSinfor32 information from the server where remote agent is running.

Make sure remote agent installation folder/dir should not be under AV scanning.

Jatin Katyal


- Do rate helpful posts -

[Prasan Venky]

Thanks for you reply. Authentication is happening without any problem.

Just for more clarity the below screen shot of problem.

.. In the logs folder, where we see 1 KB is of no logs in it. In the sense, a complete day logs are lost. Intermittently we loose logs but again it starts working. Any solution..?

And also how to collect MSinfor32 info...?

Its been a long pending issue, we tried latest patch upgrade also...

Please help.. Thanks in advance.

[Jatin Katyal]

Do you see the same intermittent logging issue with all services like csauth, rds, tcs etc.

Could you plz. provide the cslogagent file from the remote agent server when you see this issue happening.

C:\Program Files\Cisco\CiscoSecure ACS Agent\CSLogAgent\Logs

Steps to gather msinfo32

- Click the Start button.

- Click the Run option.

- Type "msinfo32" into the box and press Enter.

- Click "System Information."

- Choose "Save as System Information File" from the "Action" menu.

- Open an appropriate directory, or something easy like the desktop.

- Type "MSInfo32" into the Filename box and press Enter.

- Wait several minutes for the program to collect and save information

Did you check whether cisco remote agent server is excluded for being scanned by AV?

Jatin Katyal


- Do rate helpful posts -

[Prasan Venky]

Dear Jatin,

Yes, we are seeing this issue in all folders auth, admin... will share you the required logs shortly.

We disabled AV also in that PC where RA server installed.how many days CSLogAgent logs need to collect..?

Thanks

[Prasan Venky]

                    Logs are attached here.