CiscoWorks: Not receiving syslogs, since we change CiscoWorks server IP Address

[raza555]

Hi,

We  are using CiscoWorks 3.2.1. We have changed CiscoWorks server IP  Address, since then we are not receiving syslogs from Devices. Although  devices configurations have also been changed so that they log to new IP  Address e.g. logging new IP Address. But we are not getting syslogs now.

Rest  all operations of CiscoWorks are working ok. E.g. We can access it from  IE, inventory/config collection working, we can deploy configs etc. But  we are not getting syslogs.

Also :

Test Collector Subscription Status

SSL certificate status   SSL certificates are valid and properly imported

Collector status       Collector Server_IP_Address is up and reachable.

but I am not seeing any new alerts receiving here.

#######################################

When I do start the SyslogCollector.log/SyslogAnalyzer.log from server, I get below message;

E:\Ciscoworks\log>net start crmlog

The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

E:\Ciscoworks\log>pdexec SyslogCollector.log

ERROR: cmd failed. Server reason: Application SyslogCollector.log is not registe

red.  All requests to operate on this application will be ignored.

E:\Ciscoworks\log>pdexec SyslogAnalyzer.log

ERROR: cmd failed. Server reason: Application SyslogAnalyzer.log is not register

ed.  All requests to operate on this application will be ignored.

E:\Ciscoworks\log>

##############################################

Please advise what need to be changed on CiscoWorks in reference to new IP Address.Its required urgently.

Thanks

[fb_webuser]

Please remove logging to old IP as below: (You should get confirmation that the logging has stopped!!!)

NJ-R1(config)#no logging host 10.1.1.1

NJ-R1(config)#%SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 10.1.1.1 port 514 stopped - CLI initiated

---

Posted by WebUser Neeraj Jagga from Cisco Support Community App

[raza555]

We have already remove the logging on old IP from devices, and now about 4000 devices are logging to new IP.

Above mentioned problem is on CiscoWorks only, as its not collecting the syslogs. Below error message might suggest some solution.

#######################

E:\Ciscoworks\log>net start crmlog

The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

E:\Ciscoworks\log>pdexec SyslogCollector.log

ERROR: cmd failed. Server reason: Application SyslogCollector.log is not registered.  All requests to operate on this application will be ignored.

E:\Ciscoworks\log>pdexec SyslogAnalyzer.log

ERROR: cmd failed. Server reason: Application SyslogAnalyzer.log is not registered.  All requests to operate on this application will be ignored.

E:\Ciscoworks\log>

##################################################

[fb_webuser]

Try re-installing remote syslog collector application.

---

Posted by WebUser Neeraj Jagga from Cisco Support Community App

[raza555]

This CiscoWorks server working ok since last 2 years, we have just changed its IP Address, so syslog collection stops, rest all functions are operational I am very positive that nothing wrong with application itself, syslog just need to be reconfigured.

Do someone has good solution for it?

[Vinod Arya]

You have to resubscribe the syslog colector to itself. Go to : RME > Tools > Syslog > Syslog Collector Status and unubscribe and rescribe the syslog Collector. It should work.

Also to restart the SyslogCllector and SyslogAnalyzer above you are using wrong Process name. it is case sensitive and .log should not be used.

To Stop (from command prompt) use:

pdterm SyslogAnalyzer && pdterm SyslogCollector

To start :

pdexec SyslogAnalyzer && pdexec SyslogCollector

Attaching syslog help file I prepared on this.

-Thanks

Vinod