cisco_ucm Probe Processes Historical Syslog Alerts
Article ID: 453556
Updated On:
Products
Issue/Introduction
The cisco_ucm probe is processing large volumes of historical, redundant RTMT profile alerts. The customer reports that the probe appears to read entries from the beginning of the syslog file rather than focusing only on the most recent entries. This results in excessive event noise and potential overhead on the message bus. The customer suggests that the probe may not be utilizing a pointer to track the last processed entry in the syslog file.
Environment
- DX UIM Version : 23.4
- cisco_ucm Probe : 2.10
- Cisco Unified Communications Manager (CUCM)
Cause
The probe exhibits a defect in the timing and file pointer management logic when processing syslog files. This leads to the re-reading of historical log data upon probe startup or restart.
Resolution
To resolve the processing of historical syslog entries, apply the updated probe build containing the necessary timing and logic improvements.
1. Obtain the Updated Probe Build Download the patch version attached to this case. This build addresses the timing issues associated with log file polling.
2. Verify Environment and Backup Before applying the patch, ensure the current probe configuration (cisco_ucm.cfg) is backed up. Ensure that the UIM hub and controller services are stable.
3. Deploy the Corrective Patch Distribute and install the build to the impacted cisco_ucm probe deployment. Once the probe is updated, restart the probe process to initialize the new timing logic.
4. Validate Monitoring Monitor the probe logs to ensure that only the most recent syslog entries are processed. You should observe that historical alerts are no longer generated and the system returns to processing current events only.
Additional Information
NOTE in the build attached to this case the following fixes and enhancements are also available --> see KB: cisco_ucm probe RTMT Profiles enhancements: Custom Messages, Grouping and Test button
Attachments
Feedback
