Questions after LMS 2.6 upgrade from LMS 2.2

[yjdabear]

1. Is there a GUI counterpart to modifying NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/Collector.properties? I can't find it. Is LMS 2.5/2.6 (RME 4.x) supposed to pick up the custom syslog_info location from LMS 2.2 (RME 3.5)? If there's no GUI, how do I make LMS 2.6 re-read Collector.properties, without restarting dmgtd?

2. Is DCR supposed to pick up the entire RME 3.5 inventory and all custom "Views" during the LMS 2.2 -> 2.6 (via Dec05 update) upgrade? DCR is missing about 20% of the devices after the upgrade. Aftering importing the full inventory via a csv file, I get duplicates: one with just the hostname, one with hostname.fqdn.com. Even if I have All Devices folder checked, my search for which devices with names containing "fqdn.com" (the ones imported via the csv) returns nothing.

[yjdabear]

Does Syslog Analysis report on devices not managed (question mark on my lab router)? I'm still not seeing anything in Syslog report.

Can you attach a screenshot of what a working RME->Tools->Syslog->Syslog Collector Status looks like (preferrably without RSC), and a debug SyslogCollector.log of that? Particularly, I'm not sure these are positive or negative messages:

SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,354, Entered resurrectSubscribers()...

SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,354, SCRecoveryAssistant - Entering retrieveSubscriptionInfo()

SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,359, FcssEmblemProcessor - setPause() has been called with true

SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,359, FilterProcessor - setPause() has been called with true

SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,359, SyslogCollectorEngine - Service has been paused.

SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,360, No subscriber data file found. Not attempting a resurrection.

SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,360, Initializing Cleaner...

SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,361, Assigning shutdown hook...

SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:02,362, Syslog Collector Engine is running...

SyslogCollector - [Thread: main] DEBUG, 05 Apr 2007 12:19:04,082,

[Joe Clarke]

Attached is a screenshot, but I cannot get a debug right now. But when it's working, you will see SyslogCollector read then ew messages right out of the syslog file. You will see the raw messages being read in SyslogCollector.log, then you will see SyslogCollector decide if it needs to be filtered, or passed on to a subscribed analyzer.

For Sysloganalyzer to write the messages to the database for purposes of standard reporting, the messages need to be coming from RME managed devices.

[yjdabear]

Based on what you said, I think it might be because of the mix-bag of managed vs unmanaged state (and duplicates) of my DCR inventory.

Do you think these pkgchk failure could have anything to do the syslog problem too?

[Joe Clarke]

These pkgchk messages are fine. Even if the devices were not managed, you should still see SyslogCollector detecting new messages in the syslog file. It looks like you might not have subscribed your analyzer to the collector. What does YOUR Syslog Collector status look like?

[yjdabear]

I was wondering about that. There's no entry where "rtp-main" is on your screenshot, just "No Records". When I tried to add a subscription to "127.0.0.1" or "the external IP addr in gatekeeker.cfg" or "hostname", I got:

SLCA0126: Could not subscribe to the Collector.

1.Check whether the collector is running.

2.Make sure that SSL certificates are imported/exported correctly and process restarted.

3.Check whether the Certificates exported/imported are valid and have not expired.

4.Check whether SyslogAnalyzer process is running.

I just assume something else is broken, when that gets fixed, Syslog Analyzer will subscribe to Syslog Collector on the localhost automatically.

[Joe Clarke]

Attach an output of lsof for the SyslogCollector process as well as the AnalyzerDebug.log.

[yjdabear]

Analyzer logging level is the default INFO.

[Joe Clarke]

Please send your current Collector.properties and the output of lsof -i :4444 and lsof -i :3333.

[yjdabear]

vi /opt/CSCOpx/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/Collector.properties

"/opt/CSCOpx/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/Collector.prop

erties" 25 lines, 1000 characters

[Hit return to continue]

# Timezone related properties

TIMEZONE=EST

COUNTRY_CODE=USA

TIMEZONE_FILE=$NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/fcss/data/Time

Zone.lst

# General properties

SYSLOG_FILES=/var/log/syslog_info

#SYSLOG_FILES=/var/adm/CSCOpx/syslog/syslog_info

DEBUG_CATEGORY_NAME=SyslogCollector

DEBUG_FILE=/var/adm/CSCOpx/log/SyslogCollector.log

#DEBUG_LEVEL=INFO

DEBUG_LEVEL=DEBUG

DEBUG_MAX_FILE_SIZE=15MB

DEBUG_MAX_BACKUPS=3

DOWNTIME_DIR=$NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data

FILTER_DUMP_FILE=$NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/fi

lters.dat

# Miscellaneous properties. These are not important to users.

READ_INTERVAL_IN_SECS=1

QUEUE_CAPACITY=100000

PARSER_FILE=$NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/fcss/data/Format

Parsers.lst

SUBSCRIPTION_DATA_FILE=$NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/d

ata/Subscribers.dat

FILTER_THREADS=1

COLLECTOR_PORT=4444

lsof -i :4444

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME

java 1006 adsc01d 21u IPv4 0x3001860b0e0 0t0 TCP *:4444 (LISTEN)

lsof -i :3333

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME

cwjava 4557 casuser 27u IPv4 0x30029b86360 0t0 TCP *:3333 (LISTEN)

[Joe Clarke · Accepted solution]

What is PID 1006? I don't think this is SyslogCollector.

[yjdabear]

axxx##d 1006 998 0 Mar 22 ? 424:14 /product/confignia/dist/external/jdk-1.4.2-SunOS-sparc/bin/java -ea -DCOLLATION

It appears to be a Confignia product. It's install directory /product/confignia is 100% full. This is hogging port 4444?

[Joe Clarke]

Yeah. If you can't free up tcp/4444, that's not a problem. Either use syslogConf.pl or just modify Collector.properties directly to pick a new, free, TCP port between 1024 and 5000 (modify COLLECTOR_PORT). If you modify Collector.properties directly, then just restart SyslogCollector, else restart dmgtd.

Once that's done, you should be able to subscribe your Analyzer to your Collector (use the short hostname of the server and NOT 127.0.0.1). then you should be good to go.

[yjdabear]

Thanks, I'll try it out. Is the subscription to local Collector always a manual process? I might have missed it, but I don't think I saw any mention of that in the documentation.

[Joe Clarke]

No, it's usually automatic. Had the port not been occupied, it would have just worked.

[yjdabear]

It works out great, even with NFS-mounted syslog.

Will Cisco take a request to have line 316-ish of syslogConf.pl either removed or substantially improved? As you noted before, this step is rather pointless, since the syslog file on Sol should be owned by root. As it is, this section has no other practical purpose than [unintentionally, I think] preventing syslogConf.pl from working on a read-only NFS mount (unsupported and all).

#else

#{

#

# system("chown -R casuser:casusers $newSyslogFile");

# system("chmod 664 $newSyslogFile");

#}

A new question: Should all the NetConfig jobs be preserved by the LMS 2.6 upgrade? The Job list is empty.