02-24-2010 11:31 PM
I think this might be trouble:
After patching LMS 3.2 up, I checked Syslog Collector status. It *looked* fine, except every number is zero across the board. Toggling subscription on/off did nothing. I see an old thread with a similar issue that indicates TAC assistance with DB queries to fix config archive unique IDs is needed. Barring that, would I be able to recover by simply restoring a copy of the old LMS backup?
Forwarded | Invalid | Filtered | Dropped | Received | Up Time | Update Time | |||
1. | nms.fqdn.com | 0 | 0 | 0 | 0 | 0 | Feb 25 2010 02:22:00 Eastern Standard Time(GMT -05:00:00) | Feb 25 2010 02:28:49 Eastern Standard Time(GMT -05:00:00) |
tail -f SyslogAnalyzerUI.log
...
[ Wed Feb 24 18:19:38 EST 2010 ],INFO ,[TP-Processor6],com.cisco.nm.rmeng.common.VerifyRMELicense,validate,?,INFO: Resource Limit from License file=1500
[ Wed Feb 24 18:19:38 EST 2010 ],INFO ,[TP-Processor6],com.cisco.nm.rmeng.common.VerifyRMELicense,validate,?,
[ Thu Feb 25 02:10:42 EST 2010 ],ERROR,[TP-Processor1], Unable to initialize logging infrastructure for localization
[ Thu Feb 25 02:10:43 EST 2010 ],ERROR,[TP-Processor1],No resource is associated with key "Unable to initialize logging infrastructure for localization".
[ Thu Feb 25 02:10:43 EST 2010 ],ERROR,[TP-Processor1],Unable to initialize logging infrastructure for localization
I did a full dmgtd restart, but there's no new entry in SyslogAnalyzerUI.log:
02-24-2010 11:33 PM
tail -f AnalyzerDebug.log
[ Thu Feb 25 02:21:45 EST 2010 ],INFO ,[main],newsyslogqueue queue created with max size 100000
[ Thu Feb 25 02:21:45 EST 2010 ],INFO ,[main],processorsyslogqueue queue created with max size 100000
[ Thu Feb 25 02:21:45 EST 2010 ],INFO ,[main],Queue for new incoming syslogs created with size 100000
[ Thu Feb 25 02:21:45 EST 2010 ],INFO ,[main],Queue for action processor created with size 100000
[ Thu Feb 25 02:21:55 EST 2010 ],INFO ,[main],Action processors created
[ Thu Feb 25 02:21:55 EST 2010 ],INFO ,[main],Action processors created
[ Thu Feb 25 02:21:55 EST 2010 ],INFO ,[main],Action processors created
[ Thu Feb 25 02:21:55 EST 2010 ],INFO ,[main],Action processors created
[ Thu Feb 25 02:21:55 EST 2010 ],INFO ,[main],Action processors created
[ Thu Feb 25 02:22:00 EST 2010 ],INFO ,[main],Service started...
tail -f SyslogCollector.log
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:01:14,930, Logging System Initialized.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:01:14,932, System Initialized.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:01:14,962, Queue Cap 100000
SyslogCollector - [Thread: main] WARN , 25 Feb 2010 02:01:17,330, Unable to resurrect connection to a subscriber.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:01:17,376, Service started...
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:17:19,644, Logging System Initialized.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:17:19,646, System Initialized.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:17:19,666, Queue Cap 100000
SyslogCollector - [Thread: main] WARN , 25 Feb 2010 02:17:21,947, Unable to resurrect connection to a subscriber.
SyslogCollector - [Thread: main] INFO , 25 Feb 2010 02:17:21,993, Service started...
tail -f SyslogAnalyzerUI.log
repositories:
/WEB-INF/classes/
----------> Parent Classloader:
org.apache.catalina.loader.StandardClassLoader@170bea5
[ Wed Feb 24 18:19:38 EST 2010 ],INFO ,[TP-Processor6],com.cisco.nm.rmeng.common.VerifyRMELicense,validate,?,INFO: Resource Limit from License file=1500
[ Wed Feb 24 18:19:38 EST 2010 ],INFO ,[TP-Processor6],com.cisco.nm.rmeng.common.VerifyRMELicense,validate,?,
[ Thu Feb 25 02:10:42 EST 2010 ],ERROR,[TP-Processor1], Unable to initialize logging infrastructure for localization
[ Thu Feb 25 02:10:43 EST 2010 ],ERROR,[TP-Processor1],No resource is associated with key "Unable to initialize logging infrastructure for localization".
[ Thu Feb 25 02:10:43 EST 2010 ],ERROR,[TP-Processor1],Unable to initialize logging infrastructure for localization
02-24-2010 11:46 PM
These two appear to correspond to my manually unsubscribing the all-zero syslog collector. So my original conjecture about config archive seems bunk now, which is "good news" in its own right, but doesn't explain the zeros in SyslogCollector status.
tail -f SyslogAnalyzerUI.log
[ Thu Feb 25 02:10:42 EST 2010 ],ERROR,[TP-Processor1], Unable to initialize logging infrastructure for localization
[ Thu Feb 25 02:10:43 EST 2010 ],ERROR,[TP-Processor1],No resource is associated with key "Unable to initialize logging infrastructure for localization".
[ Thu Feb 25 02:10:43 EST 2010 ],ERROR,[TP-Processor1],Unable to initialize logging infrastructure for localization
[ Thu Feb 25 02:43:00 EST 2010 ],ERROR,[TP-Processor6], Unable to initialize logging infrastructure for localization
[ Thu Feb 25 02:43:00 EST 2010 ],ERROR,[TP-Processor6],No resource is associated with key "Unable to initialize logging infrastructure for localization".
[ Thu Feb 25 02:43:00 EST 2010 ],ERROR,[TP-Processor6],Unable to initialize logging infrastructure for localization
02-25-2010 09:53 AM
Tests have always successful from the get-go as well. Even with debug on for SyslogAnalyzer and SA UI, there's nothing revealing in the logs.
Test Collector Subscription Status | |
SSL certificate status | SSL certificates are valid and properly imported |
Collector status | Collector nms.fqdn.com is up and reachable. |
I had restored a copy of the LMS backup from this server to another. The other one has been collecting fine.
02-25-2010 10:12 AM
Finally remembered to set SyslogCollector debug in Collector.properties. It got me a clue:
SyslogCollector - [Thread: SyslogObjectForwarder] DEBUG, 25 Feb 2010 13:11:05,151, FcssSyslogObjectsForwarder - no syslogs found; returning.
SyslogCollector - [Thread: SyslogObjectForwarder] DEBUG, 25 Feb 2010 13:11:05,151, Entered zero size
02-25-2010 10:16 AM
Great, looks like somehow during the LMS 3.1 to 3.2 upgrade, SYSLOG_FILES got reset to default:
# General properties
SYSLOG_FILES=/var/log/syslog_info
DEBUG_CATEGORY_NAME=SyslogCollector
02-26-2010 10:52 AM
hi yjdabear,
do I understand you correctly that in LMS 3.1 you have changed the default syslog path but during the update the SYSLOG_FILES variable was reset to the default?
Have you changed it to the old value and now it is working again?
02-26-2010 10:54 AM
Yup, you got it all, Martin. Or, should I say "Das stimmt"?
02-26-2010 10:59 AM
So you have really earned 5 points to find this out and to jump over the 1000 mark ! :-)
...and I am sure I really need this info for the next update I plan! thanks.
02-26-2010 11:08 AM
Thanks for the points, Martin. Glad my t-shoot rambling could be useful somehow.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide