LMS 3.2 RME Automated Actions

[Wolfgang Maier]

Hi experts,

we have LMS 3.2 installation running on a Windows 2008 Enterprise Server x64. We used to trigger via RME->Automated Actions a script on a scpecific syslog event. The script is running fine when started from a DOS Shell. But when the event occurs and the message arrives in syslog nothing happens.

The script has as owner the casuser.

Does anyone have a hint on this issue? Thank you,

Regards,

Christian

[Gaganjeet Chug]

Hi,

Kindly elaborate what you are expecting when a specific syslog message hit CiscoWorks LMS server.

It would be better if you can paste the syslog message and describe the output you are expecting from CiscoWorks side.

Thanks,

Gaganjeet

[Wolfgang Maier]

Hi, thank you for your reply. Let me be a lil bit more precise.

We have multiple Layer 3 connections on a Catalyst 6509. The routing protocol we us is OSPF. Now when a OSPF Adjency Change occurs it generates a syslog message with the MNEMONIC: ADJCHG

Based on that message and the reporting interface the script generates an email with the correct interface and connection number. Also it generates a short message send vie GSM on our mobile phones.

Now, as i cannot test the script with that kind of syslog messages ( i cannot manually shut down the Layer 3 interfaces to generate that message ) i´ve setup a test automated action which looks like on the screenshot action.png. This automated action triggers the same script as for the OSPF messages

I´ve changed the mnemonic field to UPDOWN to trigger the script when a interface goes down. You can see the corresponding syslog message in syslog.png.

This message should trigger the script but nothng happens. Whe i manually start the script from the DOS-Box it works.

[Michel Hegeraat]

What helped me in the past was to copy the cmd.exe to the CSCOpx/bin directory and make it owned by casuser.

Cheers,

Michel

[Wolfgang Maier]

Hi,

i´ve copied and changed the owner of cmd.exe but i´m afraid this didn´t resolved the issue. Is there anything else i can try? Thank you

[Michel Hegeraat]

Sure,

Did you already check the sysloganalyzer.log? post it or post the relevant parts

Did you already increase the log levels for the sysloganalyzer application?

Cheers

Michel

[Wolfgang Maier]

Hi,

i´ve set the Application Logging Level to Debog (both SyslogAnalyzer and Syslog Analyzer User Interface) Then i restarted the crmdmgtd

Please see the attached file.

[Michel Hegeraat]

Restarting the deamon manager was not required, but it should do any harm and it has probably trunkated the SyslogAnalyzer.log file.

Did you make the sript run using a syslog message yet? There are no timestamps in the log so I guess not.

We need to see what it says there when the syslog message has arrived and it tries to launch the script.

There are simple syslog sender utilities that allow you to send a sting as a syslog message to your local server. Easy to have this when you test a new script.

Cheers,

Michel

[Wolfgang Maier]

Hi Michel,

OK, i´ve triggered a syslog message. You can see that this message arrives to the LMS Server.

But the \CSCOpx\log\SyslogAnalyzer.log file still doesn´t get updated. There are  no new entries in that file. It looks at if LMS doesn´t even starts the script, or am i wrong?

[Michel Hegeraat]

Yes,

If it doesn't even try to write to this file then RME is seriously broken.

Can you try to provoke a built in automated action?

Otherwise the updating of the configs and inventory are also affected.

If that doesn't work either I wouls advise to open a TAC case to get it fixed.

Cheers,

Michel

[Wolfgang Maier]

Yes, the built-in automated action doesn´t work either. I´ve tried to send an email on that syslog

event.

As far as i can see, the inventory gets updated. The last config was fetched today and a sync on the configs works also.

I guess i`ll open a TAC to fix this issue. Thank you

[Michel Hegeraat]

Your welcome,

As long as you have schedules for polling and collection then the impact is low.

You only may miss config changes between the scheduled collections

Cheers,

Michel