04-26-2012 08:21 AM - edited 03-19-2019 04:49 AM
Starting yesterday, for unknown reasons, we started getting constant RTMT alerts from our CUPS 8.5 Server (8.5.4.10000-16 HA on stand alone servers). The example alert is as follows and changes only slightly:
At Thu Apr 26 11:12:29 EDT 2012 on node HQ-CUPS-1, the following SyslogSeverityMatchFound events generated:
SeverityMatch : Alert
MatchedEvent : Apr 26 11:12:04 HQ-CUPS-1 syslog 1 nbslogpd[11946]: 271 messages were dropped
AppID : Cisco Syslog Agent
ClusterID :
NodeID : XX-XXXX-1
TimeStamp : Thu Apr 26 11:12:04 EDT 2012
No upgrades or other major changes happened yesterday. The only thing different is that we downloaded, installed and ran the new Cisco Jabber Client for Windows. The times don't match up though, we installed around 9am and the errors startded around 3:30pm.
Has anyone else seen these alerts and know what they might mean?
Solved! Go to Solution.
05-01-2012 11:28 AM
This problem has come up a few times on CUP and CUCM. Basically CUP is generating more sys log messages than the logging process is capable of writing to disk. The chances of hitting this are reduced if you do not set any service's trace levels to debug/detailed.
This is a known issue:
CSCts61745 Syslog messages dropped when Router debug logging enabled
So if you are not actively troubleshooting any issue, you can lower the logging level on certain Services, especially Cisco UP XCP Router and you'll notice the frequency of those Syslogs alerts decrease.
Logging level for services can be changed by going to CUPS Serviceability Page -> Trace -> Configuration -> Select the CUP Server -> CUP Services ->
05-01-2012 11:28 AM
This problem has come up a few times on CUP and CUCM. Basically CUP is generating more sys log messages than the logging process is capable of writing to disk. The chances of hitting this are reduced if you do not set any service's trace levels to debug/detailed.
This is a known issue:
CSCts61745 Syslog messages dropped when Router debug logging enabled
So if you are not actively troubleshooting any issue, you can lower the logging level on certain Services, especially Cisco UP XCP Router and you'll notice the frequency of those Syslogs alerts decrease.
Logging level for services can be changed by going to CUPS Serviceability Page -> Trace -> Configuration -> Select the CUP Server -> CUP Services ->
05-01-2012 12:34 PM
Thank you Jasmeet, that is very helpful.
I did also inquire with TAC, and they referred me to bug ID CSCtj94754. Both bug descriptions seem to apply. Thanks again!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide