Syslog Analyzer and RME4.0.5

[paul.pink]

I checked previous discussion regarding this topic and was unable to find a solution.  My syslog analyzer was working at one point, but now it has stopped and I can not get it back to a working condition. It appears the Analyzer is running, but not registering with the collector:

RME displays zero messages received by syslog collector

Syslog collector status always returns the following but is running

SLCA0132: Collector Status is currently not available.
Check whether the SyslogAnalyzer process is running normally.

        Process= SyslogCollector
        State  = Program started - No mgt msgs received
        Pid    = 4452
        RC     = 0
        Signo  = 0
        Start  = 7/12/2010 12:27:19 PM
        Stop   = Not applicable
        Core   = Not applicable
        Info   = Server started by admin request  

     Process= jrm
        State  = Running normally
        Pid    = 5812
        RC     = 0
        Signo  = 0
        Start  = 7/12/2010 12:27:40 PM
        Stop   = Not applicable
        Core   = Not applicable
        Info   = Server started by admin request

        Process= CTMJrmServer
        State  = Running normally
        Pid    = 9824
        RC     = 0
        Signo  = 0
        Start  = 7/12/2010 12:31:02 PM
        Stop   = Not applicable
        Core   = Not applicable
        Info   = CTMJrmServer started.

        Process= SyslogAnalyzer
        State  = Program started - No mgt msgs received
        Pid    = 4564
        RC     = 0
        Signo  = 0
        Start  = 7/12/2010 12:32:00 PM
        Stop   = Not applicable

SYSLOG Collector.log

SyslogCollector - [Thread: main] INFO , 12 Jul 2010 12:27:19,703, Logging System Initialized.
SyslogCollector - [Thread: main] INFO , 12 Jul 2010 12:27:19,703, System Initialized.
SyslogCollector - [Thread: main] INFO , 12 Jul 2010 12:27:19,917, Subscriber list is empty!
SyslogCollector - [Thread: main] INFO , 12 Jul 2010 12:27:26,247, Service started...

Tried to subscribe to the collector - received the folowing message.

SLCA0126: Could not subscribe to the Collector.
1.Check whether the collector is running.
2.Make sure that SSL certificates are imported/exported correctly and process restarted.
3.Check whether the Certificates exported/imported are valid and have not expired.
4.Check whether SyslogAnalyzer process is running.

Any help  would be appreciated.

Thanks

[Joe Clarke · Accepted solution]

You are running a very old version of RME.  You should consider upgrading to RME 4.0.6 at least.

Shutdown the SyslogCollector and SyslogAnalyzer daemons.  Empty out the contents of NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/sa/data/collectors.dat and NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/filters.dat.  Then restart both daemons, and see if the subscription occurs.  Note: due to a bug in your version of RME, this may take a long time to sync if you have numerous automated actions configured.

[paul.pink]

Thanks for the recommendatin, but no go...

[Joe Clarke]

Post the output of "netstat -a -n -o -b" with both the SyslogAnalyzer and SyslogCollector daemons running.

[paul.pink]

Joseph,

Attached is a copy of the requested output.

[paul.pink]

Joe,

I am going to have to say that what you suggested may have worked.  I just started to receive tons of emails of old messages.

[Joe Clarke]

As I said, you may be seeing an old bug where it can take a LONG time for SyslogAnalyzer to fully initialize.  That's why an upgrade to RME 4.0.6 would be a good thing to do.

[mylacapanzana]

Hi Joseph Clarke,

I am also having a problem with Syslog wherein some devices cannot generate Syslog report. I have already upgraded to RME 4.0.6 but I still have the same problem. What do you suggest that I check?

Thank you

[Joe Clarke]

Start a new thread for your issue.

[mylacapanzana]

I already created a thread for it. I really need your help. Please see link below:

https://supportforums.cisco.com/thread/2029602?tstart=0

Thanks.