Information Technology Reference
In-Depth Information
Table24-5 Troubleshooting Suggestions (continued)
Error Message
Possible Reasons
Actions
Syslog Analyzer:
message source is
given as “???” in
/var/syslog_info
(Solaris only.)
Solaris bug has
occurred; syslogd
cannot resolve the
source address of
the network device
sending the
message.
Add the name resolution for this device to
DNS,
/etc/hosts, or your naming service.
Alternatively, install the Solaris patch
103291-02. This will change the “???” to an
octal IP address in brackets
([171.69.219.72.1.2]). This allows the
format to be parsed by Syslog Analyzer.
Syslog Analyzer:
syslog messages
get appended to
/var/log/syslog_in
fo (Solaris) or to
c:\Program
Files\CSCOpx\log
\syslog.log
(Windows NT),
but all Syslog
Reports are empty.
Processes are not
running properly.
Check whether Syslog Analyzer is running
properly (Admin; System Admin; Process
Status); if not, start it.
Check that CMLogger, RmeOrb, and
DBServer are running; if not, restart the
system.
A timestamp
problem has
occurred.
If the Messages Processed counter is not
zero, check timestamps for a message in the
syslog file. If there are two timestamps and
the second timestamp is current, then the
Syslog Analyzer uses the second
timestamp. If the second timestamp is older
than 7 days, the reports do not display it.
If the Message Processed counter is zero
and the Messages Filtered counter is not
zero, then change the filters.
If the Messages Processed and Messages
Filtered counters are zero, but the Invalid
Messages counter is not zero, contact Cisco
TAC or your customer support.
Syslog Analyzer:
remote collector
not running
properly when
installed and
started on
non-Essentials
machine.
Configuration
parameters are
incorrect.
Check the remote collector table for the
name and status of the remote collector:
Admin; Syslog Analysis; Collector Status.
View SAEnvProperties.ini and check that
the parameter BGSERVER is set to the
hostname of the Essentials server.
Perform a
ping
command using this host
name to ensure that it is resolvable and
reachable from this machine.
On Windows NT, also ensure that the PORT
parameter is set to 514.
