LMS 3.2 Dropping the syslog as queue is full

[orsonjoon]

Hello,

I got this message in the SyslogCollector.log file:

SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Nov 2009 09:11:14,344, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Nov 2009 09:11:14,344, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Nov 2009 09:11:14,344, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Nov 2009 09:11:14,344, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Nov 2009 09:11:14,344, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Nov 2009 09:11:14,344, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Nov 2009 09:11:14,344, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Nov 2009 09:11:14,344, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Nov 2009 09:11:14,344, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Nov 2009 09:11:14,344, Anonymous Dropping the syslog as queue is full 100000
SyslogCollector - [Thread: EvaluatorThread-0] INFO , 10 Nov 2009 09:11:14,344, Anonymous Dropping the syslog as queue is full 100000

etc.

I did find a similar issue on the forum, but this wasn't really answered here, does anyone now what this is? A limitation of the collector or bug and how to resolve this?

At this moment no syslog messages are collected and nothing shows in the syslog report.

Thanks in advance...

[Disc01079]

Hi,

My gues is that your Syslog collector lost its connection with RME and can no longer buffer its messages, which it does when there is no connection. Try restarting the syslog analyzer or RME. Check at RME > Tools > Syslog > Syslog Collector Status if messages are being forwarded. Cheers,

Dick Hogeweg

[orsonjoon]

Hi, thanks for the response.

The first thing I did was restarting RME and completely Ciscoworks.

Test Collector Subscription Status
SSL certificate status	SSL certificates are valid and properly imported
Collector status	Collector ciscoworks is up and reachable.

Collector Status

Showing 1 records   Name Forwarded Invalid Filtered Dropped Received Up Time Update Time 1. ciscoworks 11036205 6096 4 0 11043211 Jan 7 2009 11:53:29 Central European Time(GMT +01:00:00) Jan 7 2010 12:51:33 Central European Time(GMT +01:00:00)

Everyting looks fine, but no messages appear in a syslog report.

Any ideas?

[Disc01079]

Hi, did you configure log file rotation and do you some housekeeping on your log files (CS > Server > Admin > Log rotation)? Is there enough space on your disk were your syslog.log file resides?

[ppflaum12]

Did you ever get this fixed? ... I am having the same issue.

[orsonjoon]

Hello,

The solution was a combination of fine tuning log rotation, resizing hard drives, updating device packages and bugfixes.

Cheers.