04-03-2007 12:48 PM
1. Is there a GUI counterpart to modifying NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/Collector.properties? I can't find it. Is LMS 2.5/2.6 (RME 4.x) supposed to pick up the custom syslog_info location from LMS 2.2 (RME 3.5)? If there's no GUI, how do I make LMS 2.6 re-read Collector.properties, without restarting dmgtd?
2. Is DCR supposed to pick up the entire RME 3.5 inventory and all custom "Views" during the LMS 2.2 -> 2.6 (via Dec05 update) upgrade? DCR is missing about 20% of the devices after the upgrade. Aftering importing the full inventory via a csv file, I get duplicates: one with just the hostname, one with hostname.fqdn.com. Even if I have All Devices folder checked, my search for which devices with names containing "fqdn.com" (the ones imported via the csv) returns nothing.
Solved! Go to Solution.
04-05-2007 08:30 AM
Does Syslog Analysis report on devices not managed (question mark on my lab router)? I'm still not seeing anything in Syslog report.
Can you attach a screenshot of what a working RME->Tools->Syslog->Syslog Collector Status looks like (preferrably without RSC), and a debug SyslogCollector.log of that? Particularly, I'm not sure these are positive or negative messages:
SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,354, Entered resurrectSubscribers()...
SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,354, SCRecoveryAssistant - Entering retrieveSubscriptionInfo()
SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,359, FcssEmblemProcessor - setPause() has been called with true
SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,359, FilterProcessor - setPause() has been called with true
SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,359, SyslogCollectorEngine - Service has been paused.
SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,360, No subscriber data file found. Not attempting a resurrection.
SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,360, Initializing Cleaner...
SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,361, Assigning shutdown hook...
SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,362, Syslog Collector Engine is running...
SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:04,082,
04-05-2007 08:42 AM
Attached is a screenshot, but I cannot get a debug right now. But when it's working, you will see SyslogCollector read then ew messages right out of the syslog file. You will see the raw messages being read in SyslogCollector.log, then you will see SyslogCollector decide if it needs to be filtered, or passed on to a subscribed analyzer.
For Sysloganalyzer to write the messages to the database for purposes of standard reporting, the messages need to be coming from RME managed devices.
04-05-2007 08:58 AM
04-05-2007 09:20 AM
These pkgchk messages are fine. Even if the devices were not managed, you should still see SyslogCollector detecting new messages in the syslog file. It looks like you might not have subscribed your analyzer to the collector. What does YOUR Syslog Collector status look like?
04-05-2007 09:59 AM
I was wondering about that. There's no entry where "rtp-main" is on your screenshot, just "No Records". When I tried to add a subscription to "127.0.0.1" or "the external IP addr in gatekeeker.cfg" or "hostname", I got:
SLCA0126: Could not subscribe to the Collector.
1.Check whether the collector is running.
2.Make sure that SSL certificates are imported/exported correctly and process restarted.
3.Check whether the Certificates exported/imported are valid and have not expired.
4.Check whether SyslogAnalyzer process is running.
I just assume something else is broken, when that gets fixed, Syslog Analyzer will subscribe to Syslog Collector on the localhost automatically.
04-05-2007 10:34 AM
Attach an output of lsof for the SyslogCollector process as well as the AnalyzerDebug.log.
04-05-2007 10:57 AM
04-05-2007 11:00 AM
Please send your current Collector.properties and the output of lsof -i :4444 and lsof -i :3333.
04-05-2007 11:12 AM
vi /opt/CSCOpx/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/Collector.properties
"/opt/CSCOpx/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/Collector.prop
erties" 25 lines, 1000 characters
[Hit return to continue]
# Timezone related properties
TIMEZONE=EST
COUNTRY_CODE=USA
TIMEZONE_FILE=$NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/fcss/data/Time
Zone.lst
# General properties
SYSLOG_FILES=/var/log/syslog_info
#SYSLOG_FILES=/var/adm/CSCOpx/syslog/syslog_info
DEBUG_CATEGORY_NAME=SyslogCollector
DEBUG_FILE=/var/adm/CSCOpx/log/SyslogCollector.log
#DEBUG_LEVEL=INFO
DEBUG_LEVEL=DEBUG
DEBUG_MAX_FILE_SIZE=15MB
DEBUG_MAX_BACKUPS=3
DOWNTIME_DIR=$NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data
FILTER_DUMP_FILE=$NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/fi
lters.dat
# Miscellaneous properties. These are not important to users.
READ_INTERVAL_IN_SECS=1
QUEUE_CAPACITY=100000
PARSER_FILE=$NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/fcss/data/Format
Parsers.lst
SUBSCRIPTION_DATA_FILE=$NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/d
ata/Subscribers.dat
FILTER_THREADS=1
COLLECTOR_PORT=4444
lsof -i :4444
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 1006 adsc01d 21u IPv4 0x3001860b0e0 0t0 TCP *:4444 (LISTEN)
lsof -i :3333
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
cwjava 4557 casuser 27u IPv4 0x30029b86360 0t0 TCP *:3333 (LISTEN)
04-05-2007 11:20 AM
What is PID 1006? I don't think this is SyslogCollector.
04-05-2007 11:23 AM
axxx##d 1006 998 0 Mar 22 ? 424:14 /product/confignia/dist/external/jdk-1.4.2-SunOS-sparc/bin/java -ea -DCOLLATION
It appears to be a Confignia product. It's install directory /product/confignia is 100% full. This is hogging port 4444?
04-05-2007 11:26 AM
Yeah. If you can't free up tcp/4444, that's not a problem. Either use syslogConf.pl or just modify Collector.properties directly to pick a new, free, TCP port between 1024 and 5000 (modify COLLECTOR_PORT). If you modify Collector.properties directly, then just restart SyslogCollector, else restart dmgtd.
Once that's done, you should be able to subscribe your Analyzer to your Collector (use the short hostname of the server and NOT 127.0.0.1). then you should be good to go.
04-05-2007 11:29 AM
Thanks, I'll try it out. Is the subscription to local Collector always a manual process? I might have missed it, but I don't think I saw any mention of that in the documentation.
04-05-2007 11:33 AM
No, it's usually automatic. Had the port not been occupied, it would have just worked.
04-13-2007 09:35 AM
It works out great, even with NFS-mounted syslog.
Will Cisco take a request to have line 316-ish of syslogConf.pl either removed or substantially improved? As you noted before, this step is rather pointless, since the syslog file on Sol should be owned by root. As it is, this section has no other practical purpose than [unintentionally, I think] preventing syslogConf.pl from working on a read-only NFS mount (unsupported and all).
#else
#{
#
# system("chown -R casuser:casusers $newSyslogFile");
# system("chmod 664 $newSyslogFile");
#}
A new question: Should all the NetConfig jobs be preserved by the LMS 2.6 upgrade? The Job list is empty.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide