This Document is intended to share a brief detail on Ciscoworks LMS Syslog Architechture and how it works. The Image explains the how Syslog works in LMS and some basic information required to troubleshoot the syslog issues :
For any issues with Syslog process, we need to consider some of the following points:
> First of all please check if the Syslog message is being written to Syslog.log (windows) or Syslog_info (Solaris).
> If the syslog is not coming to the log file check the network & security policies and make sure the port of Ciscoworks LMS IP is not blocked for traffic.
> Check if Syslog process is running :
# crmlog in Windows. Check if process is started in Services (CWCS Syslog Service) and available in Task manager as a process (crmlog.exe).
#syslogd in Solaris. Make sure that syslogd is running by typing in ps -ef | grep syslogd, you should see the syslogd process returned.
> Check Proper permissions for casuser and casusers on syslog.log | syslog_info.
> Check if SyslogAnalyzer and SyslogCollector are up and running and bind to their default port. Use pdshow <process name> to see the detals of the process. Example : pdshow SyslogAnalyzer.
> In case if any other process/software is using the port, we can change the default port for SyslogAnalyzer (3333/tcp) and SyslogCollector (4444/tcp) to bind them to another available port number using the NMSROOT/bin/SyslogConf.pl script.
> Sometimes a excessively huge Syslog*.db may have issues, we can drop the Db Space and Data spaces can be dropped using the NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/debugtools/dbcleanup/DBSpaceReclaimer.pl.
#NOTE: Dropping Syslog*.db Data Space will remove all the previous Syslog information from DB. It can be considered equivalent as re-init of Syslog Db.
@@ DEBUGGING OPTIONS @@
We may have to debug various processes depending on where we identify the issue. Following is the procedure to debug Syslog:
# Debugging Crmlog :
We have to turn the Debug level to 1 in registry setting in windows (Start>Run>regedit) atHKLM\SYSTEM\CurrentControlSet\Services\crmlog\Parameters. Output is written to Syslog_debug.log.
We have to modify Collector.Properties and edit DEBUG_LEVEL to DEBUG. Output is written to SyslogCollector.log.
This can done via GUI Debug Settings for SyslogAnalyzer module. In RME admin setting in LMS 3.x or earlier andadmin>system>debug settings for LMS 4.x onwards. Output is written to SyslogAnalyzer.log.
OR we can also start syslogd in debug mode, by using the following procedure:
- Stop syslogd by using /etc/init.d/syslog stop - Start syslogd in debug mode by using: /usr/sbin/syslogd -d > /tmp/syslogd_debug.txt 2>&1 - Trigger syslogs from a device and also using the following command: Logger -p local7.info "test" - Use Ctrl-C to stop syslogd in debug mode and collect the /tmp/syslogd_debug.txt file - Start syslog again normally by using /etc/init.d/syslog start
Hope this will be helpful while troubleshooting Ciscoworks LMS Syslog issues.
Maybe this is a silly question but I want to verify before I make any changes. I have several vlans configured in a domain on a bunch of 2960 switches. We had a device that was routing between a few vlans that is no longer operational. I am introduucing a...
I'm running Prime Infrastructure 3.7 and the inline upgrade failed as shown below.=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.02.24 17:04:19 =~=~=~=~=~=~=~=~=~=~=~=application upgrade PI-Upgrade-36x_37x_to_184.108.40.206.310.tar.gz CCFTPSave the current ADE-OS runnin...
I am deploying Cisco ISR 4300 Series IOS XE Universal which shall embed some IP SLA feature from the web information.I would like to ask what feature are include for Cisco ISR 4300 Series IOS XE Universal without equip APP license?Thanks for the supp...
Buen día, estimados. Queremos pedir de su amable apoyo y de sus opiniones sobre el siguiente incidente que tenemos actualmente: Tenemos dos switches modelo 4500-X conectados en VSS mediante dos fibras ópticas, dichos switches representan los COR...
Hello, I might be missing some basics on how VRFs work. But Following is configuration GNS3 (question at the bottom, image attached): PC4 -->(G2/0) R1 (G1/0.2)---> (G1/0.2) R2 PC4: ip 10.1.1.10 255.255.255.0 10.1.1.1 R...