CiscoWorks Syslog doesn't receive messages

[wkusnetsov]

Hello, can anybody help me with the following problem?

CiscoWorks (including CWCS 2.2) runs on Win2000. I can't see any syslog messages from devices both in reports and in "...CSCOpx\log\syslog.log" file. CWCS syslog service is running, but it seems it doesn't listen on port UDP-514 -- server replies with ICMP "destination port unreachable" on any syslog message sent toward CW from managed device.

How can I troubleshoot this failure, i.e. how to configure CWCS syslog service to listen on standard syslog port and to log messages to specified (CiscoWorks default "...syslog.log") file?

Thanks in advance,

Vasily

[ebreniz]

Could you please check whether there is any change in the /etc/syslog.conf file .

http://www.cisco.com/en/US/products/sw/cscowork/ps3996/products_user_guide_chapter09186a008017b774.html#wp1018862

[wkusnetsov]

Thanks for reply, ebreniz.

I use Windows version of CW, so there is no /etc/syslog.conf here. But I see that crmlog.exe process is running...

[georg.tresselt]

If you get an ICMP "destination port unreachable" you have a routing problem. Maybe, some default gateway isn't set correctly.

[wkusnetsov]

There are no problems with routing -- sniffer capture on CW shows that CW receives syslog message from the switch, and "ICMP destination port unreachable" -- it is CW server's reply...

[steve.busby]

Here's a link to troubleshoot syslog problems:

http://www.cisco.com/en/US/products/sw/cscowork/ps2073/products_user_guide_chapter09186a008017aa93.html#1003936

Right after the FAQ is a troubleshooting table that should help.

Steve

[georg.tresselt]

Check your port settings in system32\drivers\etc\services and in the registry CurrentControlSet\Services\crmlog

[wkusnetsov]

Thanks, problem have been fixed after I change wrong port number in registry.

Thanks again, georg.tresselt!