Ionix SAM/Smarts SAM Syslog Adapter: Unknown "Bad entry received..." error messages in the syslog adapter log file

Products

• VMware Smart Assurance

Issue/Introduction

Symptoms:




Unknown error messages in the Ionix SAM/Smarts SAM syslog adapter log file
Ionix SAM/Smarts SAM SysLog Adapter log reports the errors similar to the following from syslog_mgr.asl:

cisco_syslog_mgr.asl: Bad entry received in syslog_mgr.asl => May 18 11:35:01 ab1cdefg23 osad: osad shutdown failed

cisco_syslog_mgr.asl: Bad entry received in syslog_mgr.asl => May 18 11:35:02 ab1cdefg23 osad: osad startup succeeded

Environment

VMware Smart Assurance - SMARTS

Cause

The "Bad entry received..." message is a default error that is taken from the original, unedited syslog_mgr.asl file. In the above problem symptom, the original  syslog_mgr.asl was edited and renamed to  cisco_syslog_mgr.asl, but the following code for the default error was not removed from the new, renamed file when the file was edited:

DEFAULT {

   def_msg:{..eol}? } do {           print(time().ASLNAME."Bad entry received in syslog_mgr.asl => ".def_msg); }

The message is appearing in the logs because it is not matching the NOTIFY_EVENT filter { discard == "FALSE" } in the new, edited syslog_mgr.asl (cisco_syslog_mgr.asl), so the above default message is displayed in the adapter sys log.

Resolution

To resolve this issue, remove the following code from the new, edited file (cisco_syslog_mgr.asl in the preceding example): 

DEFAULT {

   def_msg:{..eol}? } do {           print(time().ASLNAME."Bad entry received in syslog_mgr.asl => ".def_msg); }