<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Verdana; font-size: 10pt; color: #000000'><div>My subscribers seem to send lots of syslog data. Make sure there are no ACLs blocking communications. </div><div><br></div><div>A simple test you can do is unplug a phone registered to the subscriber. It should send something. </div><div><br></div><div>While
on the sub, do a 'utils network capture dest <syslog_ip_addr>'. You should see something. You can then start troubleshooting upstream.<br></div><div><br></div><div>Hopefully that helps.<br></div><span><br><span name="x"></span>---<br>Lelio Fulgenzi, B.A.<br>Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1<br>(519) 824-4120 x56354 (519) 767-1060 FAX (ANNU)<br>^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^<br>Cooking with unix is easy. You just sed it and forget it. <br> - LFJ (with apologies to Mr. Popeil)<br><span name="x"></span><br></span><br><hr id="zwchr"><b>From: </b>"Tim Reimers" <treimers@ashevillenc.gov><br><b>To: </b>cisco-voip@puck.nether.net<br><b>Sent: </b>Thursday, October 11, 2012 3:00:38 PM<br><b>Subject: </b>[cisco-voip] 7.15 Subscriber not syslogging to remote syslog server..<br><br><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--><div class="WordSection1"><p class="MsoNormal">Hi all –</p><p class="MsoNormal"> </p><p class="MsoNormal">I’m trying to figure out some things using syslog.</p><p class="MsoNormal">I believe I’ve correctly configured remote syslog on both my pub/sub.</p><p class="MsoNormal"> </p><p class="MsoNormal">The publisher is correctly sending syslog data to the remote syslog server.</p><p class="MsoNormal">The subscriber never seems to send anything.</p><p class="MsoNormal"> </p><p class="MsoNormal">For the basics, the publisher is in subnet 192.168.200.X</p><p class="MsoNormal">Subscriber in subnet 192.168.201.X</p><p class="MsoNormal">Most phones are in some 10.16.X.Y subnet</p><p class="MsoNormal"> </p><p class="MsoNormal">All subnets are Vlan interfaces on one L3 switchstack, no firewalls or WAN links, etc.</p><p class="MsoNormal">i.e, everything’s locally connected, so this isn’t about slow links, access-control lists, or anything like that.</p><p class="MsoNormal"> </p><p class="MsoNormal"> </p><p class="MsoNormal">I’m seeing the below error in the syslog I do get from the CM1 (Publisher)</p><p class="MsoNormal">Device IP address shown below is the IP of the Subscriber itself.</p><p class="MsoNormal"> </p><p class="MsoNormal"> </p><p class="MsoNormal">cm1.2011-08-26.log:Aug 26 19:29:20 cm1 57: Aug 26 23:29:20.699 UTC : %CCM_CALLMANAGER-CALLMANAGER-3-DeviceTransientConnection: Transient connection attempt. Connecting Port:42653 Device name [Optional].: Device IP address [Optional].:192.168.201.6 Device type. [Optional]:255 Reason Code [Optional].:6 Protocol.:SCCP IPAddressAttributes [Optional].:0 App ID:Cisco CallManager Cluster ID:CM1-Cluster Node ID:CM1</p><p class="MsoNormal"> </p><p class="MsoNormal">I can’t figure out whether that mention of the Subscriber IP having a “device transient connection” </p><p class="MsoNormal">has anything to do with this or not.</p><p class="MsoNormal"> </p><p class="MsoNormal"> </p><p class="MsoNormal">What my ultimate goal is, is to figure out whether an ATA is registering and sometimes falling offline and reregistering.</p><p class="MsoNormal">So I thought I’d just grep my syslogs looking for that event from that device.</p><p class="MsoNormal"> </p><p class="MsoNormal">Not so easy when most devices are registered to the Subscriber, and it ain’t sayin’ anything…</p><p class="MsoNormal"> </p><p class="MsoNormal">;-) Tim</p></div><br>_______________________________________________<br>cisco-voip mailing list<br>cisco-voip@puck.nether.net<br>https://puck.nether.net/mailman/listinfo/cisco-voip<br></div></body></html>