Syslog database file size is growing

[lalit]

Hi ,

I have a Cisco Works Server ( LMS 2.6 Version) which had a issue with Syslog Severity level summary report which was hanging when ever we run a job and report job used to fail always.Also i have observed SyslogFirst.db,SyslogSecond.db,SyslogThird.db database file are grown to 90Gb Each due to which RME was very slow.

I have done a RME database Reinitilization and post to that Syslog Severity level summary report started working properly.Also the file file size of SyslogFirst.db,SyslogSecond.db,SyslogThird.db are reduced to almost 10 MB.But when i see today the SyslogThird.db file increase to 4GB again.

I need a help on what causing this files (SyslogThird.db ) to grow so fast.Is there any option whcih i need to see in cisco work which stop this files to grow so fast.Please help me on this issue.

Thanks & Regds,

Lalit

[Joe Clarke · Accepted solution]

The only thing these files hold are processed syslog messages.  If they are growing too fast, you will need to reduce the number of syslog messages processed by RME.  To do this, go to RME > Tools > Syslog > Message Filters and adjust the filters so that only the messages you care about are kept.

[lalit]

Hi Joseph,

Thanks for your valuable inputs.I have configured it as per your suggestions and now SyslogThird.db is not growing that much.

Thanks once again.One more small querry is Syslog.log files also growing huge day by day.Is there any option where i can prevent growing this file very fast.Earlier it used to grow 1Gb per day but now its around 5GB per day.

Thanks & Regds,

Lalit

[Joe Clarke · Accepted solution]

You can configure logrot.pl to periodically rotate syslog.log.  Consult the Common Services online help for "logrot" for more details.

[lalit]

Hi Joseph,

Thanks for the reply. I have already configured the Logrot.pl for Syslog rotation on a daily basis.Its rotating the syslog file but my concern is why this is growing so fast as 5GB per day.Is there any option where i can fine tune so that only required logs can be generated.

Thanks & Regds,

Lalit

[Joe Clarke]

I don't know what messages you're seeing in the log, but in general reducing the syslog severity on the devices will reduce the number of messages generated.  If you're using a severity of informational (level 6), consider reducing that to notifications (level 5).  I would not go lower than 5 for IOS devices as you will lose config change messages.  Whatever you decide, make sure that you are processing all of the messages you require to perform effective fault management of your network.

[lalit]

Hi Joseph,

Thanks for the reply.The logs which are generated is all related to dot1x Authentication.We have configured each port for dot1x.Every seconds it generates huge log for e.g Authorization failed , Authentication pass , authentication failed.All the logs are related to dot1x.There are many which related to Authorization and Authentication.

Please let me know where do i change the notifications (level 5) in RME.

Thanks & Regds,

Lalit

[Joe Clarke]

You have to change the logging severity on the devices.  If you do not, the syslog.log file will still grow.

[lalit]

Hi Joseph,

Thanks for your reply.SyslogThird.db is not growing now but my SeverityWise Summary report is stoped again.If i see status in the RME Jobs it says SeverityWise Summary report failed.I have checked the SyslogThird.db file size and found it was 20Gb.Is this is failing because 20Gb file size.

Please needs your valuable inputs.Thanks once gain.After RME reinitilization it was only 1Gb and report was getting generated.

Thanks & Regds,

Lalit

[Joe Clarke]

Post the AnalyzerDebug.log and the job log from NMSROOT/files/rme/jobs/syslog.

[lalit]

Hi Joseph,

Please find the attched AnalyzerDebug.log and job log.

Thanks & Regds,

Lalit

[Joe Clarke]

It appears SyslogAnalyzer has locked up.  Try restarting it to see if the report works:

pdterm SyslogAnalyzer

pdexec SyslogAnalyzer

[lalit]

Thanks Joseph. I will check and update.

Thanks & Regds,

Lalit