How reliable is RME Syslog Analyzer ???

[georg.tresselt]

Hi,

I'm just back from a customer who angrily scrapped CW LMS 2.2 as it turned out that not all syslog messages sent show up in syslog.log (on Win2k).

First sniffed the traffic and saw all messages passing, then we replaced the CW2k server with a Linux box as syslog host (same IP address). The UNIX syslogd received each and every syslog message while obviously Ciscoworks crmlog services missed a good deal. Even messages from CatOS and IOS devices were lost !!!

Actually, it is the first time I saw someone double-check syslog message reception that thoroughly. Most costumers I know just rely on it.

So, is there someone else how has put the reliability of RME syslog analyzer to the test ?

Cheers

Georg

[jason.aarons]

I thought I read somewhere the default CW2K behavior is to filter other then Level 7 informational, check you syslogd.conf file for what is filtered.

http://www.cisco.com/en/US/partner/products/sw/cscowork/ps2073/products_tech_note09186a00800a7275.shtml#changedefault

I also use the Kiwi CatTools syslog server, it has a great GUI for actions, logging, etc. More features then the CW2K.

[georg.tresselt]

I'm well aware of the default filters of syslog analyzer. But, the missing messages don't match them.

[robertsd4006]

Another thing to check is - was any part of VMS installed on the same box as Ciscoworks? I had a similar situation where only about 1/4 of the messages sent were being received. I removed all components of VMS (Management center for routers, MC for VPN, MC for IDS, etc.) and it now works properly. According to Cisco, there is another syslog process present in the VMS suite that does not co-exist peacefully with CW, thus causing problems. Hope this helps.

[georg.tresselt]

Interesting news as VMS includes RME afaik

[robertsd4006]

Sorry for the double post. Network was a little skippy.

Another thing to check is - was any part of VMS installed on the same box as Ciscoworks? I had a similar situation where only about 1/4 of the messages sent were being received. I removed all components of VMS (Management center for routers, MC for VPN, MC for IDS, etc.) and it now works properly. According to Cisco, there is another syslog process present in the VMS suite that does not co-exist peacefully with CW, thus causing problems. Hope this helps.

[georg.tresselt]

There is no VMS installed. The only thing on the box apart from LMS 2.2 is nGenius RTM which comes with CW2k.