6 Replies Latest reply on Aug 10, 2017 11:14 AM by wolram

    New syslog node

    aharrison

      Could anyone shed any light on how to add new syslog nodes properly.

       

      I'm trying to add an HP Procurve. I've configured it to log events to my LEM server.  I know I've got the configuration correct and the LEM server address correct because I copied and pasted the config lines from an HP switch that is logging correctly.  Yet every time I specify the node to add, it just gives me "no nodes found" no matter what I do.

       

      Just getting the one HP switch I have that's logging correctly was very very difficult and I have no idea why I was able to finally get it to appear when I ran through the Add Node Wizard.

       

      It was 5 days ago that I configured the switch in question to use the LEM server and it's still giving me "No nodes found."

       

      Any help appreciated.  Thanks!

       

      --

      Andy

        • Re: New syslog node
          wolram

          Reasons that no node may be found:

          • Is the procurve data already coming in?
            • Check which connectors you have configured on your appliance.  Click on gear next to appliance and see if an HP Procurve is already connected
            • Check the logs to see if it is actually coming in on one of the local log files
            • Configure the connector by hand without the Scan for new nodes and point the HP Procurve connector to the local logfile.  Create a new connector through Tool config
          • It is possible that the log format has changed and it is not being caught by anything
          • (Mostly applies to something that is not covered) It is possible it is not a covered connector

           

          At some point you may need to call support and have them help you out if the above things fail

            • Re: New syslog node
              aharrison
              Check which connectors you have configured on your appliance.  Click on gear next to appliance and see if an HP Procurve is already connected

               

              Only the one HP switch that's working and logging correctly is present.

               

              Check the logs to see if it is actually coming in on one of the local log files

               

              Check what logs?  The log on the HP switch?

               

              Configure the connector by hand without the Scan for new nodes and point the HP Procurve connector to the local logfile.  Create a new connector through Tool config

               

              This is already how I'm doing it.  Scan for New Nodes doesn't work.  I tried it a couple weeks ago.  I let it run for 7 hours before finally just rebooting the LEM server.  Since it had been stuck in discovery, it refused to let me add any more nodes.  At the time, I had some agent nodes I needed to add, so I had to bounce the server first since there appears to be no way to cancel a running discovery.  After that I was able to add the new agent nodes no problem.

               

              It is possible that the log format has changed and it is not being caught by anything

               

              The format has not changed.  Verified manually just to be certain.

               

              (Mostly applies to something that is not covered) It is possible it is not a covered connector

              If this were the case, then the one HP switch I was able to add wouldn't be logging correctly.

            • Re: New syslog node
              jhynds

              I'd recommend taking a look at this video - How to Troubleshoot Syslog Nodes in LEM. Around the one minute mark, it covers how to use the 'checklogs' command to verify if the logs are hitting the LEM appliance. Can you run that command and check the appropriate facility to validate that the logs are being received by LEM?

               

              Once you've confirmed that the logs are being received, we can then walkthrough the Procurve connector configuration.

              1 of 1 people found this helpful
                • Re: New syslog node
                  aharrison

                  Thanks.  That video did explain it.  That comment at the one minute mark as well as around 4:45 where it mentions that about forcing the issue and getting it to send some log data.  So I have to get some log data going before it will show up.  And I'll also make sure I set the log facility to local3 on the HP switch.  Not sure if it's the default, but I don't want to leave it to chance.

                • Re: New syslog node
                  aharrison

                  And just to close the loop for anyone else who might come looking...

                   

                  It also helps if you don't run out of "Universal" Licenses on your appliance.  If you don't have enough of these licenses and you attempt to add new syslog node, it simply ignores the new node instead of giving a useful error message.