Constant RTMT Alerts from CUPS

[joshua.gertig]

Starting yesterday, for unknown reasons, we started getting constant RTMT alerts from our CUPS 8.5 Server (8.5.4.10000-16 HA on stand alone servers). The example alert is as follows and changes only slightly:

At Thu Apr 26 11:12:29 EDT 2012 on node HQ-CUPS-1, the following SyslogSeverityMatchFound events generated:
SeverityMatch : Alert
MatchedEvent : Apr 26 11:12:04 HQ-CUPS-1 syslog 1 nbslogpd[11946]: 271 messages were dropped
AppID : Cisco Syslog Agent
ClusterID :
NodeID : XX-XXXX-1
TimeStamp : Thu Apr 26 11:12:04 EDT 2012

No upgrades or other major changes happened yesterday. The only thing different is that we downloaded, installed and ran the new Cisco Jabber Client for Windows. The times don't match up though, we installed around 9am and the errors startded around 3:30pm.

Has anyone else seen these alerts and know what they might mean?

[Jasmeet Sandhu · Accepted solution]

This problem has come up a few times on CUP and CUCM. Basically CUP is generating more sys log messages than the logging process is capable of writing to disk. The chances of hitting this are reduced if you do not set any service's trace levels to debug/detailed.

This is a known issue:

CSCts61745 Syslog messages dropped when Router debug logging enabled

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCts61745

So if you are not actively troubleshooting any issue, you can lower the logging level on certain Services, especially Cisco UP XCP Router and you'll notice the frequency of those Syslogs alerts decrease.

Logging level for services can be changed by going to CUPS Serviceability Page -> Trace -> Configuration -> Select the CUP Server -> CUP Services -> and then change from Detailed/Debug to Default/Normal and click save.

[joshua.gertig]

Thank you Jasmeet, that is very helpful.

I did also inquire with TAC, and they referred me to bug ID CSCtj94754. Both bug descriptions seem to apply. Thanks again!