[cisco-voip] SyslogSeverityMatchFound on nbslogpd

[Ryan Ratliff]

Go back through Wes' explanation of the nbslogpd.  Basically it means  
the system was very busy and syslog messages couldn't be written to  
disk as fast as they were coming in.  During a failover these could be  
simple device associations or it could signal that the same disk issue  
that affected the ccm process also affected syslog.

-Ryan

On Nov 4, 2009, at 4:46 PM, Ed Leatherman wrote:

Just ran across this thread looking for what the nbslogpd was for..
answered that question :)

Follow-up then.. so if I have an event that causes all the phones on a
subscriber node to fail over to the next CM on the list, I will have
some of these messages in syslog/RTMT alerts and its pretty well
explained why they are here right? about 1500 additional phones would
be failing over to this server inaddition to the 1500ish it already
has to keep track of.

Reason I ask is i'm trying to nail down root cause of the event and I
don't want to go barking up the wrong tree looking at this error.

On Mon, Oct 5, 2009 at 1:23 PM, Lelio Fulgenzi <lelio at uoguelph.ca>  
wrote:
> and yet our operations team insists (or insisted) on doing just that.
> deleting phones in callmanager before unplugging the phones.
>
> we'll see if it continues now after some changes have been done.
>
>
>
> ---
> Lelio Fulgenzi, B.A.
> Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1
> (519) 824-4120 x56354 (519) 767-1060 FAX (JNHN)
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> "Bad grammar makes me [sic]" - Tshirt
>
>
> ----- Original Message -----
> From: "Wes Sisk" <wsisk at cisco.com>
> To: "Ted Nugent" <tednugent73 at gmail.com>
> Cc: "Cisco VoIPoE List" <cisco-voip at puck.nether.net>
> Sent: Monday, October 5, 2009 2:20:09 PM GMT -05:00 US/Canada Eastern
> Subject: Re: [cisco-voip] SyslogSeverityMatchFound on nbslogpd
>
> your CM thanks you.  attempted registration that fails and/or
> auto-registration that fails are very "expensive" processes on CM.
> Addressing failed registration is on our "top 10" things to do when  
> we start
> on a critical account.
>
> /Wes
>
> On Monday, October 05, 2009 10:08:57 AM, Ted Nugent <tednugent73 at gmail.com 
> >
> wrote:
>
> Thank you sir I know exactly what the problem is now they have 2x  
> vg248s
> which are only half configured pounding on the cluster
>
> On Mon, Oct 5, 2009 at 9:58 AM, Wes Sisk <wsisk at cisco.com> wrote:
>>
>> nblogpd - non blocking syslog proxy implemented because the original
>> syslog would go into blocking state which would cause any logging  
>> process to
>> also block.  This was bad for ccm process when syslog got too busy.
>>
>> messages were dropped - non blocking syslog implements a buffer.   
>> When
>> buffer is filled faster than it can be written to disk then  
>> messages are
>> dropped.
>>
>> how to fix?  take a look at all syslogs  
>> (system,security,callmanager) and
>> see what is rapidly/frequently/consistently writing to the logs.   
>> Address
>> why that is happening.
>>
>> historically unconfigured or misconfigured devices have been leading
>> triggers.  They cause transient connection attempts and  
>> registration failed
>> messages repeatedly.
>>
>> /Wes
>>
>> On Monday, October 05, 2009 9:54:28 AM, Ted Nugent <tednugent73 at gmail.com 
>> >
>> wrote:
>>
>> After a new cluster upgrade to 7.1.2.31900-1 we're seeing this error
>> logging about every 4-6 hours. I can't seem to find any info on the  
>> nbslogpd
>> service? Anyone know what this might be about and how i might fix  
>> it? TIA
>>
>> SyslogSeverityMatchFound events generated: SeverityMatch - Alert
>> nbslogpd[13840]: 72 messages were dropped SeverityMatch - Alert
>> nbslogpd[13840]: 2 messages were dropped
>>
>> ________________________________
>> _______________________________________________
>> cisco-voip mailing list
>> cisco-voip at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>
>
>
>
> _______________________________________________ cisco-voip mailing  
> list
> cisco-voip at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>
>



-- 
Ed Leatherman
_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip