LMS 4.0 Syslog time issue

[MarioLieb]

Hi @ all

i have an error using the syslog in Cisco Works LMS 4. All the syslog entries are 4 hours later than at the switch.

The time zone on the switch is set

clock summer-time MESZ recurring last Sun Mar 2:00 last Sun Oct 3:00

The Timezone on the Server is

(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna

I don´t know who the server get this wrong time ...

Any idea ?!?!?!?

Thanks

Mario

[ngoldwat]

Hi,

Are you stating that the timestamp is seemingly incorrect but that you are receiving the messages as expected?  Could you post an example? 

How to Correct Syslog Timestamp on a Catalyst Switch

In order to ensure that timestamp is enabled, issue the following command, ensuring that set time and set timezone are correct:

set logging timestamp enable

How to Correct Syslog Timestamp on a Router

In order to ensure the correct time is displayed, issue the following command, ensuring that set clock has correct time in enable mode and correct timezone is specified in with set clock timezone in global config:

sh clock

[glenn.funtilon]

Hi,

I'm having the same issue. The syslog message on the device itself is correct and when it sends it to the syslog server (LMS) and verified it in the syslog.log file they are exactly the same including the time stamps.. However, when I generate a syslog message report throug device center, there are missing syslogs and the time and date are kinda off.. have a look:

[MarioLieb]

Hi,

soory for the late Answer. I´d have the same issue like Glenn. At the syslog- file the time is showing corect. But if i

make a Report in Works the time is differnt to the syslog-file (+4 hours)

Regards Mario

[glenn.funtilon]

Hi Mario,

You need to configure a supported timezone acronym on your managed devices. Say for example, in our network we configured the timezone to be "PH" but I found out later that the LMS does not recognize this timezone acronym. Since PH timezone is also +8 GMT, I should've configured my devices to use "CCT" timezone as indicated here in the release notes:

http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.0/release/notes/lms40rel.html#wp55504

But I did not want to change the configuration on my devices so I opted to do another method detailed in the "Timezone List Used By Syslog Collector" and "Understanding the Syslog Collector Properties File" in this document:

http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_resource_manager_essentials/4.3/user/guide/syslog.html#wp1218756

So after editing the the "TimeZone.lst" and the "Collector.properties" and saving them, then restarting daemon manager, everything was spot on.

HTH

[MarioLieb]

Hi Glenn

sorry this solution doesn´t work ... or i made a misstake ... When i changed the settings and restart the Demon nothing happend. The timeshift is + 4 hours. If i changed the Timesetting to "PH" then i had an timeshift of + 2 hours .... ???

Maybe you have a look at the attached Files ??? Here also one Screenshot ...

Thanks Mario

[glenn.funtilon]

Hi Mario,

Are the managed devices and the LMS server both in the same time zone? In your first post, you said the you are +1:00 GMT but in the screenshot you posted it is at +2:00 GMT.

If it should be +2:00GMT on the switch also, try using the "MEST" acronym on your clock summer-time since this is for +2:00 GMT.

HTH

[MarioLieb]

Hi @ all hi Glenn

many thanks for your help ;-). I´d soved the problem.

This is my solution.

The WorksServer works with CEST ... and the switches too (clock timezone cest 1). But i have a config which tells the switch when the time will be changed from summer to winter time.

clock summer-time MESZ recurring last Sun Mar 2:00 last Sun Oct 3:00

Here i done this with MESZ. It seems that Works doesn´t know MESZ. So i changed the config at the switches to

clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00

After that the time is correct in the syslog-reports.

Thanks

Mario