CISCO Collector 2.8.1 - Vmware - audit: backlog limit exceeded

[Added Solucoes]

Hi,

Collector on customer has normal boot process interrupted by auditd daemon that shows the following messages:

audit: backlog limit exceeded

audit: backlog limit exceeded

audit: backlog limit exceeded

After that, we have a prompt to enter in single mode user, Give root password for maintenance or CTRL + D to continue, but if we give CTRL + D to continue we have the boot interrupted again showing the same audit messages, as explained earlier.

As result collector is offline now.

Thanks in advance.

Luciano.

[adias]

I seems to be a Kernel Panic where likely he has deployed the wrong specs for CSPC SNTC, please request the present specs on the VM.. additionally it seems that the panic is caused by a catch 22. there is is no enough resources causes the collector to create logs, kern.log and messages log gets the harddrive to 100% usage.  Please send the specs in which he has deployed this collector. for verification.

[Added Solucoes]

Hi,

The specs is:

VMWare ESXI 6.0
CPU: 2 Core
RAM: 2 GB
HD: 40 GB

Customer has no more than 200 hosts.

Thanks in advance.
Luciano

[adias]

As predicted that is what happened as far as resources and 100% hard drive usage.  Those specs (tiny) are not supported for the SNTC service. so It had the behaviour I mentioned. That specs is only to be used as a single iteration Transaction engagement typically for another service (BCS)

For SNTC It must be at least the small version.  there is not enough storage or memory or cpu for the SNTC service.  He will need to redeploy.

To deploy the collector on the Vmware Esxi host, configure the network and set the CLI passwords as per attached document.

• Downloading  CSPC 2.8.1.4 and Installing the OVA(VMWare)

• On installation of the ova it has the full appliance OS, application, and all necessary third party on the ova. So all you need is install the ova and follow the instructions.

In deploying it will ask the size of the network that will provide the requirements and automatically configure the ova to that requirement, based on my experience the best suited for your network will be to choose at least the Small (10K devices) deployment for good performance . If possible select a  higher option for  better performance 

• Review the Cisco CSPC 2.8 CLI guide attached   . This guide goes over the required set up of the collector on CLI for the configuration of the required CLI linux users (collectorlogin, root )

[Added Solucoes]

Hi,

Just for reference, the specs are according to version 2.8.1 guide:

https://community.cisco.com/t5/forums/replypage/board-id/4891-discussions-smart-net-total-care/message-id/12901

That says the settings we provisioned are ok for a ultra small installation, but my guess is the SNTC was updated automatically to a high version that could have a higher hardware requirements as you pointed.

I will reschedule the reinstalation with customer.

Thanks in advance.

Luciano

[adias]

thank you what is the link of the Guide you mentioned? For me to verify. To be more clear if this is the GUIDE you mention

The collector itself is multi-service and used across the organization. Some services may be able to use that light spec so it is a valid for the collector.  But it is the service that determined the requirement for the specs. To be fair with you that light collector is an exception and therefore confusing for reviewing the document and an enhancement request has been made to modify its nomenclature for only valid for transaction single iterations service only.

https://www.cisco.com/c/dam/en/us/support/docs/cloud-systems-management/common-services-platform-collector-cspc/CSPC-Quick-Start-Guide.pdf

[adias · Accepted solution]

Ola Luciano Please mark this post as answered/resolved.