CiscoWorks Resource Manager Essentials

Installing Remote Syslog Analyzer Collector on UNIX for Essentials 3.3

  • Viewing Options

  • PDF (293.2 KB)
  • Feedback
Installing the Remote Syslog Analyzer Collector on UNIX

Table Of Contents

Installing the Remote Syslog Analyzer Collector on UNIX

Upgrading a Syslog Analyzer Collector

Preparing to Install a Syslog Analyzer Collector

For Solaris Systems

For AIX Systems

For HP-UX systems

Installing the Syslog Analyzer Collector

Properties Variables Table

Uninstalling the Syslog Analyzer Collector

Obtaining Documentation

World Wide Web

Ordering Documentation

Documentation Feedback

Obtaining Technical Assistance

Technical Assistance Center

Contacting TAC by Using the Cisco TAC Website

Contacting TAC by Telephone

Installing the Remote Syslog Analyzer Collector on UNIX

The Syslog Analyzer Collector can be installed on a remote UNIX machine to process syslog messages. If necessary, it can also filter the syslog messages before forwarding them to the Syslog Analyzer process on the Essentials server. You can uninstall the Syslog Analyzer Collector later, if you do not want to run it on the remote UNIX server.

You can install the Syslog Analyzer Collector on a UNIX system.

This document contains:

Upgrading a Syslog Analyzer Collector

Preparing to Install a Syslog Analyzer Collector

Installing the Syslog Analyzer Collector

Uninstalling the Syslog Analyzer Collector

Obtaining Documentation

Obtaining Technical Assistance

Upgrading a Syslog Analyzer Collector

If you have previously installed a remote Syslog Analyzer collector with JRE 1.1.6, and you are upgrading to a new remote collector, you must:

Step 1 Uninstall JRE 1.1.6, if necessary.

Step 2 Remove the Syslog Analyzer collector from the directory in which it was installed.

Preparing to Install a Syslog Analyzer Collector

Make sure JDK or JRE is installed on the machine on which you will install the Syslog Analyzer collector.

For Solaris Systems

Note JRE 1.2 is the lowest version you can use to run the remote Syslog Analyzer collector.

You can access the Sun Microsystem's site for JRE 1.2 and above at or you can obtain it from the server as follows:

Step 1 Obtain the JRE from the server in the /opt/CSCOpx/lib/jre directory by entering:

#cd /opt/CSCOpx/lib/
#tar CVF /jre2.tar jre2

Step 2 Using FTP, transfer the /tmp/jre.tar file to the client machine.


# tar xvf /jre.tar

For AIX Systems

You can access the IBM site for the JDK 1.1.8 at

For HP-UX systems

To obtain the latest version of the JRE, refer to the HP website at

Installing the Syslog Analyzer Collector

Step 1 Log in to the remote server as root.

Step 2 Set the JRE CLASSPATH variable to the appropriate directory or Jar files.

Step 3 Uncompress SAC.bin.Z by entering:

# uncompress SAC.bin.Z

Step 4 Run the Bourne-shell shar script SAC.bin, for example, sh SAC.bin.

Step 5 When the installation script asks where to install the CSCOsac package, select a directory.

If you do not select a directory, the product is automatically installed in the /opt directory.

Caution Do not remove the symbolic link between the /opt directory and the selected

If you do select a directory, enter the fully qualified pathname to the directory so that a smbolic link can be made to it from the /opt directory.

The installation script creates a script and a script in the /opt/CSCOsac/lib directory. These scripts are used to start and stop the Syslog Analyzer collector.

Note Ensure that the entry is present in /etc/syslog.conf, since the install routine does not add this entry to the syslog.conf file. If in not present, make an entry in /etc/syslog.conf file as follows: /var/log/syslog_info. Restart the syslog daemon after making the changes.

The script will also ask for the location of the JRE or Java executable. For example, if the JRE or Java executable is installed in /usr/jdk1.2/bin, enter:


If JRE or Java executable is installed in /opt/CSCOpx/lib/jre2/bin/sparc/native-threads/java, enter:


Step 1 If you have not already done so, modify the SAenvProperties.ini file in the following directory:


Use the values in the Properties Variables Table to modify the SAenvProperties.ini file.

Step 2 Configure the startup method.

You can use two methods to start up the Syslog Analyzer collector: automatically when the server boots or manually.

Note Before you start the Syslog Analyzer collector automatically, make sure you have modified the SAenvProperties.ini file with the appropriate value.

To start the Syslog Analyzer collector when the server boots, add the start script ( to the system boot startup files.

To start the Syslog Analyzer collector manually, do one of the following:

To start the collector manually without passing it arguments, enter: sh /opt/CSCOsac/lib/

To start the collector manually and pass it arguments:

a. Set your classpath to /opt/CSCOsac/classpath, for example, if the default shell is csh, enter:


b. Pass the Syslog Analyzer collector arguments by entering:

java [arguments]

The TransProcess executable is located in the /opt/CSCOsac/lib/classpath/com/cisco/nm/sysloga/sac directory. .

c. The Remote Syslog Analyser collects debug and error messages in a file. By default this file is stored in the install directory.


If the install directory is changed, then the location of the log file is:


Note Specify arguments only if you want parameters that differ from those in your SAenvProperties.ini file. You can specify either syslog filename or syslog port number for the Syslog Analyzer collector to read from; you cannot specify both at the same time. Use the values in the Properties Variables table to modify your SAenvProperties.ini file.

Table 1 Arguments

-sf<syslog file name-sf>

syslog file name

-sp<syslog port #>

syslog port number

-bsn<bg server name>

Essentials server name

-bsp<bg server port>

Essentials port number

-bnd<orb bind name>

orb bind name

-dbg [1-6]

debug modes 1-6


print usage information

Step 3 To stop the Syslog Analyzer collector, enter:

sh /opt/CSCOsac/lib/

or you can stop the Java or JRE process if it was started manually.

Properties Variables Table

Table 2 Properties Variables Table



File from which syslog messages are read. Set a value if a syslog daemon is running on the server.


Number of the port on which syslog messages are coming in, typically, port 514. Specify the number of the port from which Syslog Analyzer Collector reads syslog messages.


Essentials server to which Syslog Analyzer Collector forwards parsed and filtered messages.


Number of port used by RmeOrb process on Essentials server.

To check port number:

1. Using a browser, log in to the Essentials server.

2. Select Server > Administration > Process Management > Process Status. The Process Status table appears.

3. Scroll down and click RmeOrb. The Process Details window appears.

4. In the Flags row, note the port number (after the -p option).


Syslog Analyzer Collector version. Recommended version is 1.0.


Name used by Syslog Analyzer Collector to bind to OSAgent process. Value should be the same as value set for SAC_SERVER variable and followed by ::SaReceiver.

For example, if SAC_SERVER variable is set to, then BINDNAME variable should be set to nm-bgdemo::SaReceiver.

Make sure the name you enter for this variable matches the Essentials server name exactly.

To find out the name under which the Essentials server is registered, refer to the value set for PX_HOST in the file, This file is located in install_dir/lib/classpath, where install_dir is the directory in which CiscoWorks2000 is installed (C:\Program Files\CSCOpx by default).


Debug level in which you run the Syslog Analyzer Collector.

Note It is recommended that you retain the default value which is 4, as this reports ERRORS. Setting it to any other value might result in a large number of debug messages being reported.


Name Syslog Analyzer Collector uses for printed ERROR or DEBUG messages. It is recommended that you retain the default value, SyslogAnalyzer.

Uninstalling the Syslog Analyzer Collector

In the /opt/CSCOsac directory, enter:
rm -rf CSCOsac 

Obtaining Documentation

The following sections provide sources for obtaining documentation from Cisco Systems.

World Wide Web

You can access the most current Cisco documentation on the World Wide Web at the following sites:

Ordering Documentation

Cisco documentation is available in the following ways:

Registered Cisco Direct Customers can order Cisco Product documentation from the Networking Products MarketPlace:

Registered users can order the Documentation CD-ROM through the online Subscription Store:

Nonregistered users can order documentation through a local account representative by calling Cisco corporate headquarters (California, USA) at 408 526-7208 or, in North America, by calling
800 553-NETS(6387).

Documentation Feedback

If you are reading Cisco product documentation on the World Wide Web, you can submit technical comments electronically. Click Feedback in the toolbar and select Documentation. After you complete the form, click Submit to send it to Cisco.

You can e-mail your comments to

To submit your comments by mail, use the response card behind the front cover of your document, or write to the following address:

Attn Document Resource Connection
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-9883

We appreciate your comments.

Obtaining Technical Assistance

Cisco provides as a starting point for all technical assistance. Customers and partners can obtain documentation, troubleshooting tips, and sample configurations from online tools. For registered users, additional troubleshooting tools are available from the TAC website. is the foundation of a suite of interactive, networked services that provides immediate, open access to Cisco information and resources at anytime, from anywhere in the world. This highly integrated Internet application is a powerful, easy-to-use tool for doing business with Cisco. provides a broad range of features and services to help customers and partners streamline business processes and improve productivity. Through, you can find information about Cisco and our networking solutions, services, and programs. In addition, you can resolve technical issues with online technical support, download and test software packages, and order Cisco learning materials and merchandise. Valuable online skill assessment, training, and certification programs are also available.

Customers and partners can self-register on to obtain additional personalized information and services. Registered users can order products, check on the status of an order, access technical support, and view benefits specific to their relationships with Cisco.

To access, go to the following website:

Technical Assistance Center

The Cisco TAC website is available to all customers who need technical assistance with a Cisco product or technology that is under warranty or covered by a maintenance contract.

Contacting TAC by Using the Cisco TAC Website

If you have a priority level 3 (P3) or priority level 4 (P4) problem, contact TAC by going to the TAC website:

P3 and P4 level problems are defined as follows:

P3—Your network performance is degraded. Network functionality is noticeably impaired, but most business operations continue.

P4—You need information or assistance on Cisco product capabilities, product installation, or basic product configuration.

In each of the above cases, use the Cisco TAC website to quickly find answers to your questions.

To register for, go to the following website:

If you cannot resolve your technical issue by using the TAC online resources, registered users can open a case online by using the TAC Case Open tool at the following website:

Contacting TAC by Telephone

If you have a priority level 1(P1) or priority level 2 (P2) problem, contact TAC by telephone and immediately open a case. To obtain a directory of toll-free numbers for your country, go to the following website:

P1 and P2 level problems are defined as follows:

P1—Your production network is down, causing a critical impact to business operations if service is not restored quickly. No workaround is available.

P2—Your production network is severely degraded, affecting significant aspects of your business operations. No workaround is available.