Hi,
You indicate that CiscoWorks is not collecting syslogs from all devices. So you are collecting syslogs from some devices? If so what sort of devices are not showing up?
Here are the snippits I found in your logs:
1st one:
SyslogCollector - [Thread: SyslogObjectForwarder] ERROR, 12 May 2010 18:24:54,127, Could not send syslogs, removing the subscriber...Connection refused: connect
Examples
SyslogCollector - [Thread: Thread-10] WARN , 04 Dec 2009 13:12:23,996, Unable to add monitor for OurServerName
SyslogCollector - [Thread: Thread-10] WARN , 28 Oct 2011 15:33:59,461, Unable to add monitor for OurServerName
Looks like you ran out of space back in November of last year: Please verify if you have any java.io.IOException exception in dcmaservice.log.
CRMLogger- Sun Nov 14 05:36:57 GMT 2010 5 CRMLoggerException := LogWriter :: flush() : Unable to flush the stream : java.io.IOException: There is not enough space on the disk
CRMLogger- Mon Apr 18 08:51:31 BST 2011 5 CRMLoggerException := LogWriter :: add(String) : Unable to write to filestream : java.io.IOException: There is not enough space on the disk
[ Wed Oct 26 11:07:07 BST 2011 ],ERROR,[TP-Processor8],isDuplicate() -
java.lang.NullPointerException
at com.cisco.nm.rmeng.sa.ui.reports.datagenerators.SyslogCustomReportHelper.isDuplicate(SyslogCustomReportHelper.java:277)
at com.cisco.nm.rmeng.sa.ui.reports.action.SyslogCRTMAction.performWizard(SyslogCRTMAction.java:433)
at com.cisco.nm.rmeng.sa.ui.reports.action.SyslogCRTMAction.perform(SyslogCRTMAction.java:335)
at org.apache.struts.action.ActionServlet.processActionPerform(ActionServlet.java:1786)
at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1585)
at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:509)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:647)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:269)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
at com.cisco.nm.cmf.util.AccessLogFilter.doFilter(AccessLogFilter.java:128)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:172)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:108)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:174)
at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:200)
at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:291)
at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:775)
at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:704)
at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:897)
at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:689)
at java.lang.Thread.run(Thread.java:662)
Please verify/provide the following:
1) That TCP ports 3333 and 4444 are not occupied by a third party application
a) netstat -anob
2) What is the output of '../CSCOpx/bin perl.exe perl.exe resolver.pl '
Also '../CSCOpx/bin perl.exe perl.exe resolver.pl '
3) For testing verify that any host firewall and/or end point protection is disabled
4) The output of pdshow -brief
5) Select Resource Manager Essentials > Tools > Syslog. Go to Syslog Collector Status page and attach a screen-shot
6) Please provide the amount of available space left on your disk.
Thanks
