MARS Error Log Message Thread 53300144:AnaRawmsgFileReader::

[cschweigert]

     Anyone have any idea about the below message from MARS? It is showing up frequently in the Backend Log Messages..

Error

./pnesloader

Thread 53300144:AnaRawmsgFileReader::Read: NOT found the two separators in  the end.

[Jennifer Halim]

seems like it is affected by bugID: CSCsv92424:

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsv92424

Hope that answers your question.

[cschweigert]

Thanks for the reply Jennifer. Do you think that all the logging levels should be adjusted?

[Jennifer Halim]

It's only affected by devices that are sending "blank" syslog messages. It is worth investigating which devices sent "blank" syslog and modify the logging on the device itself, instead of changing the logging level on MARS itself.

If it's not possible to check which devices are sending blank syslogs, then you can change the logging level on MARS to "fatal":

Admin->System Maintenance->Set Runtime Logging level

[cschweigert]

Any suggestions on identifying the system  that is sending blank syslog messages? I have a LogLogics device that is forwarding syslog messages that are from various different devices. Meaning way to many to count.. But I can view those messages. I also tried looking through a  capture of the raw messages from the MARS, and there is obviously a lot of information there, I am not quite as good of a database query machine as the MARS is..