CiscoWorks Resource Manager Essentials

Table Of Contents

Installing the Remote Syslog Analyzer Collector on Windows

Preparing to Install the Syslog Analyzer Collector

Installing the Syslog Analyzer Collector

Configuring the Syslog Analyzer Collector to Run Automatically

Uninstalling the Syslog Analyzer Collector

Obtaining Documentation

World Wide Web

Documentation CD-ROM

Ordering Documentation

Documentation Feedback

Obtaining Technical Assistance

Cisco.com

Technical Assistance Center

Cisco TAC Web Site

Cisco TAC Escalation Center

Installing the Remote Syslog Analyzer Collector on Windows

---

The Syslog Analyzer Collector can be installed on a remote Windows 2000 system to process syslog messages. If necessary, it can also filter the syslog messages before forwarding them to the Syslog Analyzer process on the Essentials server. You can uninstall the Syslog Analyzer Collector later, if you do not want to run it on the remote UNIX or Windows server.

Do not install Remote Syslog Analyzer Collector on a system that has CiscoWorks2000 and Resource Manager Essentials already installed. If you are installing it on a system that also has Essentials installed in it, stop the CRM logger service before installing Remote Syslog Analyzer Collector. This is because CRM logger will hook to the UDP port and read all the syslog messages. When the SacNTService tries to connect to the same port to read the syslog messages, it gets an Address Not Found exception, and therefore, does not read any syslog messages arriving on the port.

The Syslog Analyzer Collector uses CORBA, an Essentials system service, to communicate with the Essentials server. It functions as follows:

1. At startup, the Syslog Analyzer Collector tries to connect to the Syslog Analyzer on the Essentials server through CORBA (RmeOrb process), which runs on the Essentials server.

2. After it is connected, the Syslog Analyzer Collector:

a. Obtains the filters it needs from the Essentials server to filter syslog messages.

b. Sends status to the Syslog Analyzer process about the collected syslog messages, including the number of messages read, number of messages filtered, and number of messages with bad syntax. It also forwards unfiltered messages to the Syslog Analyzer process.

You can install the Syslog Analyzer Collector on a UNIX system or on a Windows system.

This document contains information on:

•Preparing to Install the Syslog Analyzer Collector

•Installing the Syslog Analyzer Collector

•Configuring the Syslog Analyzer Collector to Run Automatically

•Uninstalling the Syslog Analyzer Collector

•Obtaining Documentation

•Obtaining Technical Assistance

Preparing to Install the Syslog Analyzer Collector

---

Step 1 Make sure Internet Explorer 4.01. or later is installed on the remote server.

Step 2 Obtain the installation file from the Essentials server using either of the following methods:

•Using FTP from the /opt/CSCOpx/htdocs/rdist/sysloga directory of the Essentials server.

•Through a browser on the remote server at this location:

http://CiscoWorks2000_server:port/sysloga/SAC.html

---

Note To access this page, you must first log on to the CiscoWorks2000, and open a new a browser window from the CiscoWorks2000 window.

---

Step 3 Download SacNTService.exe or NT Remote Collector.

Step 4 Obtain the SAenvProperties.ini file from the same location from where you obtained the SacNTService.exe file.

Step 5 Place the file in any directory you want. You will need to specify its location when you start the Syslog Analyzer Collector, so make sure to remember the location.

Step 6 Update each variable in this file with the appropriate values from the Properties Variables Table.

Table 1 Properties Variables Table 

Variable	Description
FILE	File from which syslog messages are read. Set a value if a syslog daemon is running on the server.
SAC_PORT	Port number on which syslog messages are coming in, typically, port 514. Specify the port number from which Syslog Analyzer Collector reads syslog messages.
SAC_SERVER	Essentials server to which Syslog Analyzer Collector forwards parsed and filtered messages.
SAC_SERVER_PORT	Port number used by RmeOrb process on Essentials server. To check the port number: 1. Using a browser, log in to the Essentials server. 2. Select Server > Administration > Process Management > Process Status. The Process Status table appears. 3. Scroll down and click RmeOrb. The Process Details window appears. 4. In the Flags row, note the port number (after the -p option).
VERSION	Syslog Analyzer Collector version. Recommended version is 1.0.
BINDAME	Name used by Syslog Analyzer Collector to bind to OSAgent process. The value should be the same as the value set for the SAC_SERVER variable and followed by ::SaReceiver. For example, if the SAC_SERVER variable is set to nm_bgdemo.cisco.com, then the BINDNAME variable should be set to nm-bgdemo::SaReceiver. Make sure the name you enter for this variable matches the Essentials server name exactly. To find out the name under which the Essentials server is registered, refer to the value set for PX_HOST in the file, md.properties. This file is located in install_dir/lib/classpath, where install_dir is the directory in which CiscoWorks2000 is installed (C:\Program Files\CSCOpx by default).
DEBUG_LEVEL	Debug level in which you run the Syslog Analyzer Collector. Note It is recommended that you retain the default value, which is 4, as this reports error messages. Setting it to any other value might result in a large number of debug messages being reported.
SA_APP_NAME	Name Syslog Analyzer Collector uses for printed error or debug messages. It is recommended that you retain the default value, SyslogAnalyzer.

Installing the Syslog Analyzer Collector

---

Step 1 From the command line, enter SacNTService /install to install the SAC service.

---

Note Do not add the .exe extension to the SacNTService file.

---

Step 2 Modify the SAenvProperties.ini file, if you have not already done so.

Step 3 To start the service, select Start > Settings > Control Panel > Services.

The Services window appears.

Step 4 Select Cisco Syslog Collector.

Step 5 In the Startup Parameters field, enter the location of your SAenvProperties.ini file, for example:

-pr c:\\directory\\SAenvProperties.ini

---

Note Make sure you use two backslashes (\\) when you specify the pathname, and remember to use the -pr argument; otherwise, the Syslog Analyzer Collector will not run. The directory name should be in DOS format. Refer to Configuring the Syslog Analyzer Collector to Run Automatically for additional control information.

---

Step 6 Click Start.

The error and debug messages are collected in a log file. You can specify the name and location of this log file. The log file with the specified name is created by the process. The format of the location path is:

drive_name:\location_directory\logfile_name

It is mandatory to mention the path.

If the directory structure does not exist, then the error and debug messages are put into the event viewer. The default location of the log file is:

C:\Program Files\SyslogRemoteCollector.log

To run the Syslog Analyzer Collector with different parameters, include additional arguments when you enter the full pathname of the properties file.The Arguments Table contains more information on the arguments.

Table 2 Arguments Table

Arguments
-pr properties file name	properties file name
-sf syslog file name	syslog file name
-sp syslog port #	syslog port number
-bsn bg server name	Essentials server name
-bsp bg server port	Essentials port number
-bnd orb bind name	orb bind name
-dbg [1-6]	debug modes 1-6
-h	print usage information

For example, enter:

C:\\tmp\\SAenvProperties.ini -bsn sbanks-ss20.cisco.com -bsp 420 -bnd 
sbanks-ss20::SaReceiver

Step 7 To stop the Syslog Analyzer Collector:

a. Select Start > Programs > Administration Tools > Services.

The Services window appears.

b. Select Cisco Syslog Collector.

c. Click Stop.

---

Configuring the Syslog Analyzer Collector to Run Automatically

You can store the Properties file location in the Windows registry to avoid specifying the Properties file in the start up parameters of the service window. During startup, if no parameters are specified, the Syslog Analyzer Collector will look in the registry for the location of the Properties file.

To store the Properties file in the registry, from the command line, enter:

SacNTService /cmd:SacNTService -pr C:\\directory\\SAenvProperties.ini 
-set

---

Note You can store only the Properties file location in the registry; any other command line options are ignored.

---

To run the Syslog Analyzer Collector automatically every time the machine starts up:

---

Step 1 Select Start > Programs > Administration Tools > Services.

The Services window appears.

Step 2 Select Cisco Syslog Collector

Step 3 Click Startup.

Step 4 Select Automatic.

Step 5 Click OK.

---

Uninstalling the Syslog Analyzer Collector

---

Step 1 Select Start > Settings > Control Panel > Services.

The Services window appears.

Step 2 Select Cisco Syslog Collector.

Step 3 Stop the Syslog Collector service.

Step 4 In the directory where you installed the SacNTService.exe file, enter:

SacNTService / uninstall

Obtaining Documentation

These sections explain how to obtain documentation from Cisco Systems.

World Wide Web

You can access the most current Cisco documentation on the World Wide Web at this URL:

http://www.cisco.com

Translated documentation is available at this URL:

http://www.cisco.com/public/countries_languages.shtml

Documentation CD-ROM

Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which is shipped with your product. The Documentation CD-ROM is updated monthly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual subscription.

Ordering Documentation

You can order Cisco documentation in these ways:

•Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Networking Products MarketPlace:

http://www.cisco.com/cgi-bin/order/order_root.pl

•Registered Cisco.com users can order the Documentation CD-ROM through the online Subscription Store:

http://www.cisco.com/go/subscription

•Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, U.S.A.) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387).

Documentation Feedback

You can submit comments electronically on Cisco.com. In the Cisco Documentation home page, click the Fax or Email option in the "Leave Feedback" section at the bottom of the page.

You can e-mail your comments to bug-doc@cisco.com.

You can submit your comments by mail by using the response card behind the front cover of your document or by writing to the following address:

Cisco Systems
Attn: Document Resource Connection
170 West Tasman Drive
San Jose, CA 95134-9883

We appreciate your comments.

Obtaining Technical Assistance

Cisco provides Cisco.com as a starting point for all technical assistance. Customers and partners can obtain online documentation, troubleshooting tips, and sample configurations from online tools by using the Cisco Technical Assistance Center (TAC) Web Site. Cisco.com registered users have complete access to the technical support resources on the Cisco TAC Web Site.

Cisco.com

Cisco.com is the foundation of a suite of interactive, networked services that provides immediate, open access to Cisco information, networking solutions, services, programs, and resources at any time, from anywhere in the world.

Cisco.com is a highly integrated Internet application and a powerful, easy-to-use tool that provides a broad range of features and services to help you with these tasks:

•Streamline business processes and improve productivity

•Resolve technical issues with online support

•Download and test software packages

•Order Cisco learning materials and merchandise

•Register for online skill assessment, training, and certification programs

If you want to obtain customized information and service, you can self-register on Cisco.com. To access Cisco.com, go to this URL:

http://www.cisco.com

Technical Assistance Center

The Cisco Technical Assistance Center (TAC) is available to all customers who need technical assistance with a Cisco product, technology, or solution. Two levels of support are available: the Cisco TAC Web Site and the Cisco TAC Escalation Center.

Cisco TAC inquiries are categorized according to the urgency of the issue:

•Priority level 4 (P4)—You need information or assistance concerning Cisco product capabilities, product installation, or basic product configuration.

•Priority level 3 (P3)—Your network performance is degraded. Network functionality is noticeably impaired, but most business operations continue.

•Priority level 2 (P2)—Your production network is severely degraded, affecting significant aspects of business operations. No workaround is available.

•Priority level 1 (P1)—Your production network is down, and a critical impact to business operations will occur if service is not restored quickly. No workaround is available.

The Cisco TAC resource that you choose is based on the priority of the problem and the conditions of service contracts, when applicable.

Cisco TAC Web Site

You can use the Cisco TAC Web Site to resolve P3 and P4 issues yourself, saving both cost and time. The site provides around-the-clock access to online tools, knowledge bases, and software. To access the Cisco TAC Web Site, go to this URL:

http://www.cisco.com/tac

All customers, partners, and resellers who have a valid Cisco service contract have complete access to the technical support resources on the Cisco TAC Web Site. The Cisco TAC Web Site requires a Cisco.com login ID and password. If you have a valid service contract but do not have a login ID or password, go to this URL to register:

http://www.cisco.com/register/

If you are a Cisco.com registered user, and you cannot resolve your technical issues by using the Cisco TAC Web Site, you can open a case online by using the TAC Case Open tool at this URL:

http://www.cisco.com/tac/caseopen

If you have Internet access, we recommend that you open P3 and P4 cases through the Cisco TAC Web Site.

Cisco TAC Escalation Center

The Cisco TAC Escalation Center addresses priority level 1 or priority level 2 issues. These classifications are assigned when severe network degradation significantly impacts business operations. When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC engineer automatically opens a case.

To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to this URL:

http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml

Before calling, please check with your network operations center to determine the level of Cisco support services to which your company is entitled: for example, SMARTnet, SMARTnet Onsite, or Network Supported Accounts (NSA). When you call the center, please have available your service agreement number and your product serial number.

Installing the Remote Syslog Analyzer Collector on Windows
Copyright © 2002, Cisco Systems, Inc.
All rights reserved.