Unable to generate syslog report

[mylacapanzana]

Hi Everyone,

I am unable to generate a syslog report for most of the devices. When I checked syslog.log it appeared that these same devices are not logging there as well. Action taken are:

-restart daemon manager

-restart server

-unsubscribe and subscribe syslog collector

-restart sysloganalyzer and syslogcollector

-restart cwsyslog from services.msc.

Setup:

Cisco Mars is getting logs from the devices-> CSM is getting logs from Mars-> LMS is getting logs from CSM.

both Mars and CSM are generating logs.

Will appreciate your help.

Thanks.

[ccarring]

Are the syslog messages being forwarded to the LMS server from somewhere, or do your devices send syslog directly to LMS server?

Do I understand correctly that you receive syslog messages in the LMS syslog.log file, but only for CSM?

Try a sniffer trace at the CiscoWorks server and find out if the device syslogs are arriving at the server. If they are, then it will need to be verified that they are in proper EMBLEM format.

[mylacapanzana]

Yes, the syslog collector of LMS is pointed to CSM. I observed that the problem started after upgrading RME so I uninstall and reinstall RME but we still have the same problem. CSM can generate syslog report for all devices but LMS only function for some devices.

[ccarring]

I'm confused by "the syslog collector of LMS is pointed to CSM".

I tend to thing it's the devices that get pointed at (i.e., configured to send log messages to) the syslog collecter. Unless it's the case that you have a remote syslog analyzer collecter?

This might be as simple as making a subscription to it. Go to

RME->Tools->Syslog->Syslog Collector Status

Is there a subscription for the syslog collector? If not, make one... if there is a subscription, test it.

Hopefully that will get you moving in the right direction!

Curtis

[mylacapanzana]

Hi Curtis,

I don't think so, it is properly working before. The only difference is that it is getting the logs from CSM. Maybe these logs can help.

Hi Joe Clark,

Please help me. I really don't have any more idea.

[mylacapanzana]

Here are the logs.

[mylacapanzana]

Anyone who has idea?