NCM 5.0 Syslog Server question

Hi all,
In looking over the release notes and documentation, it appears that NCM 5.0 has it's own Syslog server. We have Orion v9 installed on 2 servers (one Primary Poller/Web and a Second Poller). The Second Poller houses our existing Orion Syslog Service, and has a *LOT* of records due to ASA Firewall messages coming in.

I want to be able to use the NCM Real Time Change Detection. Is there a pre-requisite to use the NCM 5.0 Syslog Server? And how would that impact the size of the NCM database? Would it be redundant or collide with the Orion v9 Syslog Service?
Thanks,
Stephen

Find more posts tagged with

syslog

ncm

upgrade

Accepted answers

All comments

chris.lapoint

Is there a pre-requisite to use the NCM 5.0 Syslog Server?

We essentially packaged the full Orion NPM Syslog Server with NCM. So the only gotcha is if Orion NPM Sylog Server is already installed on the same machine, NCM won't install its Syslog Server.

And how would that impact the size of the NCM database?

It depends on the number of change events that you expect to flow to the database. If you only point change events to the NCM Syslog Server, I don't expect it to make any dramatic impact.

Would it be redundant or collide with the Orion v9 Syslog Service?

It depends. If you installed NCM on a different server than your Orion Syslog Service, then it would be redundant. If you installed NCM on a the same server as your Orion Syslog Service, then it wouldn't install its own.

NOTE: Realtime Change Detection works best when the Syslog Server is installed on the same machine as NCM. Here's a high-level description of how Realtime Change Detection works (see Admin Guide for detailed instructions):

1) Network device is configured to send syslog events on config changes

2) Syslog server will receive a syslog event from network device

3) Syslog server will need to analyze the event and determine if it's a config change event (see example in Admin Guide for setting up rule for Cisco)

4) If it's a change event, Syslog server will need to trigger an alert action to run ConfigAutoDownload.exe ${IP} NOTE: This is an executable on the NCM server which is why having Syslog and NCM on the same server works best. The IP address must exist in NCM database.

5) ConfigAutoDownload will download the latest running config and compare it to the previous. If there are changes, it will send notification as configured in File > Settings > Realtime Change Detection

HTH.

skirven

AHA! So it's much like the existing prcess, with the addition of being able to add a Syslog service on the server if one doesn't already exists! We actually installed Cirrus 4 on the same server as the second poller, which had the Orion Syslog service for that reason. We then put in the alert action to kick off the EXE file.

One thing I did notice in the existing process was that if you had "Device A", with "IP Address A" loaded in Cirrus, and a change came through via Syslog, with "IP Address B", then the change wouldn't download, because it didn't do a lookup on the IP Addresses table. Has this been addressed?
Thanks,
Stephen

chris.lapoint

If you are referring to an issue where RTCD did not match properly on multi-homed devices, this has been resolved in 5.0. For internal folks, this was #1265.

FormerMember

We essentially packaged the full Orion NPM Syslog Server with NCM. So the only gotcha is if Orion NPM Sylog Server is already installed on the same machine, NCM won't install its Syslog Server.

Hi,

I have just installed NCM 5.0 onto the same server as Orion v9. NCM installed a new Syslog server and disabled my original syslog server! The service for the original syslog server now no longer starts. This is only a problem because in the Orion web console the Syslog tab is refering to the old Syslog server and is only diplaying data from before the upgrade. Any ideas on how i go about fixing the Orion web interface so that it will display the data from the new NCM Syslog server?

Chris

chris.lapoint

That's definitely not the intended behavior and we'll want to fix this for sure. Can you try stopping the NCM Syslog Server and then try restarting your NPM Syslog Server. It may be an issue with port conflict. Let me know how this goes.

FormerMember

Hi Chris,

Stpping the new NCM Syslog server and starting the original has fixed the issue. I can now see syslog data back in my orion web console. FYI it is a port conflict that is preventing both Syslog servers from running at the same time. In the SolarWinds.Net event logs this is showing up as an error with the event id 1019 when you try to start the second Syslog server.

Thanks for your help.

Chris