NCM: Which files have to be checked if Syslogs are not received/processed by NCM?

Products

• VMware Smart Assurance

Environment

VMware Smart Assurance - NCM

Resolution

How to confirm Smarts NCM is correctly configured to manage syslogs



Check for the corresponding device model xml file, if the pull config flag is set to 1, by default its 1. If it is set to zero, the pull config action will not be performed even though syslog is received by NCM.

Ex: If the device is CiscoIOSRouter, check CiscoIOSRouterSysLog.xml file at <Basedir>/smarts-ncm/package/pkgxml/CiscoIOSRouter and <Basedir>/smarts-ncm/custompackage/pkgxml/CiscoIOSRouter.



Check /etc/syslog file, if you are using rsyslog service instead of syslog, check /etc/rsyslog file, to verify the syslog write file entry. Make sure below highlighted entry exists, as NCM reads syslog from <Basedir>/smarts-ncm/cm/Syslog file.



If rsyslog is being used, you will need to add below lines to the eventlogrotate.d file at /etc/logrotate.d path for log rotation to happen in syslog file, for active processing of syslogs in NCM.

Default file:

Entries to be added:
/opt/smarts-ncm/cm/Syslog {
rotate 7
daily
size=100k
sharedscripts
postrotate
if ps -ae | grep rsyslogd > /dev/null
then
/usr/bin/killall -HUP rsyslogd
fi

if ps -ae | grep [^r]syslogd > /dev/null
then
/usr/bin/killall -HUP syslogd
fi
endscript
}
 

Additional Information

Also check https://supoort.emc.com/kb/185167 for more details. If after verifying all the above entries, issue persists, raise a SR with EMC Technical Support team.