LMS2.5 reports empty on syslog

[scain2]

I have several daily reports that run against syslog.These worked fine until 31 Dec but since 1st Jan they show successful but empty. Checking syslog for the devices shows they are logging to syslog fine

[David Stanford]

What is the size of the file syslog.log or syslog_info? Are you rotating your log files periodically?

[scain2]

Purge every 7 days, not very large, stranage how since start of new year. I can run a report for Dec 31st fine with data

[David Stanford]

I would do the following to troubleshoot and debug this:

Make sure SyslogCollector and SyslogAnalyzer processes are running (verify by running pdshow). If they aren't running, try to start the manually via pdexec.

If they are running follow these steps:

Enable debug for syslog:

To set the debug on syslog go to RME -> Admin -> System Preferences -> Loglevel

Settings -> Application: syslog anaylzer -> level: debug

Next

Select a device that is managed in RME and is sending syslog messages to the server

-- Telnet to that device and enter conf t and exit (do this a couple of times) and this should generate a config change syslog message

-- Go to the syslog.log or syslog_info file and see if this message makes it to the log

-- If it makes it to the log go to RME - Reports - Report Generator and

select Syslog and Severity Level Summary Report

-- Select that device and run the report. Do you see any messages for severity 5? If so then click on the number and see if the messages you just created made it to the report.

If it fails to make it to the report, have a look at the SyslogCollector.log or AnalyzerDebug.log and look for the IP address of the problem device. Any errors or messages related to it?