On a recent install of observium, I’ve noticed some oddities with Syslog collection… Some devices are being collected just fine, but others are not.
In the example screenshot included below, my firewall ***10, and one switch ***04 are both being collected just fine. But the switches 75***** and *****50 are not. http://i.imgur.com/nxupFzJ.png
One thing I noticed was that someone had turned on “service sequence-numbers” on the ****04 switch. (The ASA has no such feature that I know of.. ) When I disabled this service, the collection stopped working on that device! Example here…http://i.imgur.com/HViWcTk.png
Thoughts? Thanks!!
-Tony
It might be beneficial to know what that syslog message was supposed to be. Although I don't monitor many Cisco gear, I do monitor a lot of Adtran, and I haven't had to change much of anything to get it working with syslog-ng and Observium.
Thank you, Nicholas
From: observium [mailto:observium-bounces@observium.org] On Behalf Of Anthony Mattke Sent: Friday, June 27, 2014 10:26 AM To: observium@observium.org Subject: [Observium] Odd issue with Syslog collection
On a recent install of observium, I've noticed some oddities with Syslog collection... Some devices are being collected just fine, but others are not.
In the example screenshot included below, my firewall ***10, and one switch ***04 are both being collected just fine. But the switches 75***** and *****50 are not. http://i.imgur.com/nxupFzJ.png
One thing I noticed was that someone had turned on "service sequence-numbers" on the ****04 switch. (The ASA has no such feature that I know of.. ) When I disabled this service, the collection stopped working on that device! Example here...http://i.imgur.com/HViWcTk.png
Thoughts? Thanks!!
-Tony
Mostly it’s the same messages that start working when I enable the sequence numbers.
Lots of Duplex mismatches and such…
Works: 1423983: Jun 27 10:52:54 EST: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/16 (not full duplex), with xxxxx.local FastEthernet0/0 (full duplex).
Doesn’t: Jun 27 10:53:13 EST: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/16 (not full duplex), with xxxxx.local FastEthernet0/0 (full duplex).
On Jun 27, 2014, at 11:50 AM, Nick Beacham nick@nexgencom.com wrote:
It might be beneficial to know what that syslog message was supposed to be. Although I don’t monitor many Cisco gear, I do monitor a lot of Adtran, and I haven’t had to change much of anything to get it working with syslog-ng and Observium.
Thank you, Nicholas
From: observium [mailto:observium-bounces@observium.org] On Behalf Of Anthony Mattke Sent: Friday, June 27, 2014 10:26 AM To: observium@observium.org Subject: [Observium] Odd issue with Syslog collection
On a recent install of observium, I’ve noticed some oddities with Syslog collection… Some devices are being collected just fine, but others are not.
In the example screenshot included below, my firewall ***10, and one switch ***04 are both being collected just fine. But the switches 75***** and *****50 are not. http://i.imgur.com/nxupFzJ.png
One thing I noticed was that someone had turned on “service sequence-numbers” on the ****04 switch. (The ASA has no such feature that I know of.. ) When I disabled this service, the collection stopped working on that device! Example here…http://i.imgur.com/HViWcTk.png
Thoughts? Thanks!!
-Tony _______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
I don't think it's anything with Observium, try debugging syslog-ng. Stop the service and run Syslog-ng -Fevd
See how the alerts are coming in...problem is, you'll have to wait for the duplex mismatch, unless you have the resources to test it.
Thank you, Nicholas
From: observium [mailto:observium-bounces@observium.org] On Behalf Of Anthony Mattke Sent: Friday, June 27, 2014 10:56 AM To: Observium Network Observation System Subject: Re: [Observium] Odd issue with Syslog collection
Mostly it's the same messages that start working when I enable the sequence numbers.
Lots of Duplex mismatches and such...
Works: 1423983: Jun 27 10:52:54 EST: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/16 (not full duplex), with xxxxx.local FastEthernet0/0 (full duplex).
Doesn't: Jun 27 10:53:13 EST: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/16 (not full duplex), with xxxxx.local FastEthernet0/0 (full duplex).
On Jun 27, 2014, at 11:50 AM, Nick Beacham <nick@nexgencom.commailto:nick@nexgencom.com> wrote:
It might be beneficial to know what that syslog message was supposed to be. Although I don't monitor many Cisco gear, I do monitor a lot of Adtran, and I haven't had to change much of anything to get it working with syslog-ng and Observium.
Thank you, Nicholas
From: observium [mailto:observium-bounces@observium.org] On Behalf Of Anthony Mattke Sent: Friday, June 27, 2014 10:26 AM To: observium@observium.orgmailto:observium@observium.org Subject: [Observium] Odd issue with Syslog collection
On a recent install of observium, I've noticed some oddities with Syslog collection... Some devices are being collected just fine, but others are not.
In the example screenshot included below, my firewall ***10, and one switch ***04 are both being collected just fine. But the switches 75***** and *****50 are not. http://i.imgur.com/nxupFzJ.png
One thing I noticed was that someone had turned on "service sequence-numbers" on the ****04 switch. (The ASA has no such feature that I know of.. ) When I disabled this service, the collection stopped working on that device! Example here...http://i.imgur.com/HViWcTk.png
Thoughts? Thanks!!
-Tony _______________________________________________ observium mailing list observium@observium.orgmailto:observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Syslog-ng is logging everything to disk just fine..
Sent from my iPhone
On Jun 27, 2014, at 12:08 PM, Nick Beacham nick@nexgencom.com wrote:
I don’t think it’s anything with Observium, try debugging syslog-ng. Stop the service and run Syslog-ng –Fevd
See how the alerts are coming in…problem is, you’ll have to wait for the duplex mismatch, unless you have the resources to test it.
Thank you, Nicholas
From: observium [mailto:observium-bounces@observium.org] On Behalf Of Anthony Mattke Sent: Friday, June 27, 2014 10:56 AM To: Observium Network Observation System Subject: Re: [Observium] Odd issue with Syslog collection
Mostly it’s the same messages that start working when I enable the sequence numbers.
Lots of Duplex mismatches and such…
Works: 1423983: Jun 27 10:52:54 EST: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/16 (not full duplex), with xxxxx.local FastEthernet0/0 (full duplex).
Doesn’t: Jun 27 10:53:13 EST: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on FastEthernet0/16 (not full duplex), with xxxxx.local FastEthernet0/0 (full duplex).
On Jun 27, 2014, at 11:50 AM, Nick Beacham nick@nexgencom.com wrote:
It might be beneficial to know what that syslog message was supposed to be. Although I don’t monitor many Cisco gear, I do monitor a lot of Adtran, and I haven’t had to change much of anything to get it working with syslog-ng and Observium.
Thank you, Nicholas
From: observium [mailto:observium-bounces@observium.org] On Behalf Of Anthony Mattke Sent: Friday, June 27, 2014 10:26 AM To: observium@observium.org Subject: [Observium] Odd issue with Syslog collection
On a recent install of observium, I’ve noticed some oddities with Syslog collection… Some devices are being collected just fine, but others are not.
In the example screenshot included below, my firewall ***10, and one switch ***04 are both being collected just fine. But the switches 75***** and *****50 are not. http://i.imgur.com/nxupFzJ.png
One thing I noticed was that someone had turned on “service sequence-numbers” on the ****04 switch. (The ASA has no such feature that I know of.. ) When I disabled this service, the collection stopped working on that device! Example here…http://i.imgur.com/HViWcTk.png
Thoughts? Thanks!!
-Tony _______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
participants (3)
-
Anthony Mattke -
Anthony R. Mattke
-
Nick Beacham