Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Cisco: VOIP

SyslogSeverityMatchFound on nbslogpd

 

 

Cisco voip RSS feed   Index | Next | Previous | View Threaded


tednugent73 at gmail

Oct 5, 2009, 6:54 AM

Post #1 of 8 (222 views)
Permalink
SyslogSeverityMatchFound on nbslogpd

After a new cluster upgrade to 7.1.2.31900-1 we're seeing this error logging
about every 4-6 hours. I can't seem to find any info on the nbslogpd
service? Anyone know what this might be about and how i might fix it? TIA


SyslogSeverityMatchFound events generated: SeverityMatch - Alert
nbslogpd[13840]: 72 messages were dropped SeverityMatch - Alert
nbslogpd[13840]: 2 messages were dropped


wsisk at cisco

Oct 5, 2009, 6:58 AM

Post #2 of 8 (215 views)
Permalink
Re: SyslogSeverityMatchFound on nbslogpd [In reply to]

nblogpd - non blocking syslog proxy implemented because the original
syslog would go into blocking state which would cause any logging
process to also block. This was bad for ccm process when syslog got too
busy.

messages were dropped - non blocking syslog implements a buffer. When
buffer is filled faster than it can be written to disk then messages are
dropped.

how to fix? take a look at all syslogs (system,security,callmanager)
and see what is rapidly/frequently/consistently writing to the logs.
Address why that is happening.

historically unconfigured or misconfigured devices have been leading
triggers. They cause transient connection attempts and registration
failed messages repeatedly.

/Wes

On Monday, October 05, 2009 9:54:28 AM, Ted Nugent
<tednugent73[at]gmail.com> wrote:
>
> After a new cluster upgrade to 7.1.2.31900-1 we're seeing this error
> logging about every 4-6 hours. I can't seem to find any info on
> the nbslogpd service? Anyone know what this might be about and how i
> might fix it? TIA
>
>
> SyslogSeverityMatchFound events generated: SeverityMatch - Alert
> nbslogpd[13840]: 72 messages were dropped SeverityMatch - Alert
> nbslogpd[13840]: 2 messages were dropped
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip[at]puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>


tednugent73 at gmail

Oct 5, 2009, 7:08 AM

Post #3 of 8 (214 views)
Permalink
Re: SyslogSeverityMatchFound on nbslogpd [In reply to]

Thank you sir I know exactly what the problem is now they have 2x vg248s
which are only half configured pounding on the cluster


On Mon, Oct 5, 2009 at 9:58 AM, Wes Sisk <wsisk[at]cisco.com> wrote:

> nblogpd - non blocking syslog proxy implemented because the original
> syslog would go into blocking state which would cause any logging process to
> also block. This was bad for ccm process when syslog got too busy.
>
> messages were dropped - non blocking syslog implements a buffer. When
> buffer is filled faster than it can be written to disk then messages are
> dropped.
>
> how to fix? take a look at all syslogs (system,security,callmanager) and
> see what is rapidly/frequently/consistently writing to the logs. Address
> why that is happening.
>
> historically unconfigured or misconfigured devices have been leading
> triggers. They cause transient connection attempts and registration failed
> messages repeatedly.
>
> /Wes
>
> On Monday, October 05, 2009 9:54:28 AM, Ted Nugent <tednugent73[at]gmail.com><tednugent73[at]gmail.com>wrote:
>
> After a new cluster upgrade to 7.1.2.31900-1 we're seeing this error
> logging about every 4-6 hours. I can't seem to find any info on the nbslogpd
> service? Anyone know what this might be about and how i might fix it? TIA
>
>
> SyslogSeverityMatchFound events generated: SeverityMatch - Alert
> nbslogpd[13840]: 72 messages were dropped SeverityMatch - Alert
> nbslogpd[13840]: 2 messages were dropped
>
> ------------------------------
>
> _______________________________________________
> cisco-voip mailing listcisco-voip[at]puck.nether.nethttps://puck.nether.net/mailman/listinfo/cisco-voip
>
>
>


lelio at uoguelph

Oct 5, 2009, 7:30 AM

Post #4 of 8 (215 views)
Permalink
Re: SyslogSeverityMatchFound on nbslogpd [In reply to]

Ed Leatherman deserves credit for this one.

We have configured all ports, even if some have
No extension. This way you get no errors.
Instruct your MAC desk to only delete the
extension. This also eliminates any requirement
to connect to the VG to enable the ports. Even
Setting the port to auto will enabl when cables are
Connected but won't disable it.

Lelio Fulgenzi, Senior Analyst
Computing & Communications
University of Guelph
519-824-4120 x56354

...sent from my iPod - please pardon my fat fingers ;)

[XKJ2000]

On 2009-10-05, at 10:22 AM, Ted Nugent <tednugent73[at]gmail.com> wrote:

> Thank you sir I know exactly what the problem is now they have 2x
> vg248s which are only half configured pounding on the cluster
>
>
> On Mon, Oct 5, 2009 at 9:58 AM, Wes Sisk <wsisk[at]cisco.com> wrote:
> nblogpd - non blocking syslog proxy implemented because the original
> syslog would go into blocking state which would cause any logging
> process to also block. This was bad for ccm process when syslog got
> too busy.
>
> messages were dropped - non blocking syslog implements a buffer.
> When buffer is filled faster than it can be written to disk then
> messages are dropped.
>
> how to fix? take a look at all syslogs
> (system,security,callmanager) and see what is rapidly/frequently/
> consistently writing to the logs. Address why that is happening.
>
> historically unconfigured or misconfigured devices have been leading
> triggers. They cause transient connection attempts and registration
> failed messages repeatedly.
>
> /Wes
>
>
> On Monday, October 05, 2009 9:54:28 AM, Ted Nugent <tednugent73[at]gmail.com
> > wrote:
>> After a new cluster upgrade to 7.1.2.31900-1 we're seeing this
>> error logging about every 4-6 hours. I can't seem to find any info
>> on the nbslogpd service? Anyone know what this might be about and
>> how i might fix it? TIA
>>
>>
>>
>> SyslogSeverityMatchFound events generated: SeverityMatch - Alert
>> nbslogpd[13840]: 72 messages were dropped SeverityMatch - Alert
>> nbslogpd[13840]: 2 messages were dropped
>>
>>
>> _______________________________________________
>> cisco-voip mailing list
>> cisco-voip[at]puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>
>
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip[at]puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip


wsisk at cisco

Oct 5, 2009, 11:20 AM

Post #5 of 8 (207 views)
Permalink
Re: SyslogSeverityMatchFound on nbslogpd [In reply to]

your CM thanks you. attempted registration that fails and/or
auto-registration that fails are very "expensive" processes on CM.
Addressing failed registration is on our "top 10" things to do when we
start on a critical account.

/Wes

On Monday, October 05, 2009 10:08:57 AM, Ted Nugent
<tednugent73[at]gmail.com> wrote:
> Thank you sir I know exactly what the problem is now they have 2x
> vg248s which are only half configured pounding on the cluster
>
>
> On Mon, Oct 5, 2009 at 9:58 AM, Wes Sisk <wsisk[at]cisco.com
> <mailto:wsisk[at]cisco.com>> wrote:
>
> nblogpd - non blocking syslog proxy implemented because the
> original syslog would go into blocking state which would cause any
> logging process to also block. This was bad for ccm process when
> syslog got too busy.
>
> messages were dropped - non blocking syslog implements a buffer.
> When buffer is filled faster than it can be written to disk then
> messages are dropped.
>
> how to fix? take a look at all syslogs
> (system,security,callmanager) and see what is
> rapidly/frequently/consistently writing to the logs. Address why
> that is happening.
>
> historically unconfigured or misconfigured devices have been
> leading triggers. They cause transient connection attempts and
> registration failed messages repeatedly.
>
> /Wes
>
>
> On Monday, October 05, 2009 9:54:28 AM, Ted Nugent
> <tednugent73[at]gmail.com> <mailto:tednugent73[at]gmail.com> wrote:
>>
>> After a new cluster upgrade to 7.1.2.31900-1 we're seeing this
>> error logging about every 4-6 hours. I can't seem to find any
>> info on the nbslogpd service? Anyone know what this might be
>> about and how i might fix it? TIA
>>
>>
>> SyslogSeverityMatchFound events generated: SeverityMatch - Alert
>> nbslogpd[13840]: 72 messages were dropped SeverityMatch - Alert
>> nbslogpd[13840]: 2 messages were dropped
>>
>> ------------------------------------------------------------------------
>>
>> _______________________________________________
>> cisco-voip mailing list
>> cisco-voip[at]puck.nether.net <mailto:cisco-voip[at]puck.nether.net>
>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>
>
>


lelio at uoguelph

Oct 5, 2009, 11:23 AM

Post #6 of 8 (206 views)
Permalink
Re: SyslogSeverityMatchFound on nbslogpd [In reply to]

and yet our operations team insists (or insisted) on doing just that. deleting phones in callmanager before unplugging the phones.

we'll see if it continues now after some changes have been done.



---
Lelio Fulgenzi, B.A.
Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1
(519) 824-4120 x56354 (519) 767-1060 FAX (JNHN)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
"Bad grammar makes me [sic]" - Tshirt


----- Original Message -----
From: "Wes Sisk" <wsisk[at]cisco.com>
To: "Ted Nugent" <tednugent73[at]gmail.com>
Cc: "Cisco VoIPoE List" <cisco-voip[at]puck.nether.net>
Sent: Monday, October 5, 2009 2:20:09 PM GMT -05:00 US/Canada Eastern
Subject: Re: [cisco-voip] SyslogSeverityMatchFound on nbslogpd

your CM thanks you. attempted registration that fails and/or auto-registration that fails are very "expensive" processes on CM. Addressing failed registration is on our "top 10" things to do when we start on a critical account.

/Wes

On Monday, October 05, 2009 10:08:57 AM, Ted Nugent <tednugent73[at]gmail.com> wrote:



Thank you sir I know exactly what the problem is now they have 2x vg248s which are only half configured pounding on the cluster



On Mon, Oct 5, 2009 at 9:58 AM, Wes Sisk < wsisk[at]cisco.com > wrote:



nblogpd - non blocking syslog proxy implemented because the original syslog would go into blocking state which would cause any logging process to also block. This was bad for ccm process when syslog got too busy.

messages were dropped - non blocking syslog implements a buffer. When buffer is filled faster than it can be written to disk then messages are dropped.

how to fix? take a look at all syslogs (system,security,callmanager) and see what is rapidly/frequently/consistently writing to the logs. Address why that is happening.

historically unconfigured or misconfigured devices have been leading triggers. They cause transient connection attempts and registration failed messages repeatedly.

/Wes


On Monday, October 05, 2009 9:54:28 AM, Ted Nugent <tednugent73[at]gmail.com> wrote:





After a new cluster upgrade to 7.1.2.31900-1 we're seeing this error logging about every 4-6 hours. I can't seem to find any info on the nbslogpd service? Anyone know what this might be about and how i might fix it? TIA




SyslogSeverityMatchFound events generated: SeverityMatch - Alert nbslogpd[13840]: 72 messages were dropped SeverityMatch - Alert nbslogpd[13840]: 2 messages were dropped
_______________________________________________
cisco-voip mailing list cisco-voip[at]puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-voip



_______________________________________________ cisco-voip mailing list cisco-voip[at]puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-voip


ealeatherman at gmail

Nov 4, 2009, 1:46 PM

Post #7 of 8 (91 views)
Permalink
Re: SyslogSeverityMatchFound on nbslogpd [In reply to]

Just ran across this thread looking for what the nbslogpd was for..
answered that question :)

Follow-up then.. so if I have an event that causes all the phones on a
subscriber node to fail over to the next CM on the list, I will have
some of these messages in syslog/RTMT alerts and its pretty well
explained why they are here right? about 1500 additional phones would
be failing over to this server inaddition to the 1500ish it already
has to keep track of.

Reason I ask is i'm trying to nail down root cause of the event and I
don't want to go barking up the wrong tree looking at this error.

On Mon, Oct 5, 2009 at 1:23 PM, Lelio Fulgenzi <lelio[at]uoguelph.ca> wrote:
> and yet our operations team insists (or insisted) on doing just that.
> deleting phones in callmanager before unplugging the phones.
>
> we'll see if it continues now after some changes have been done.
>
>
>
> ---
> Lelio Fulgenzi, B.A.
> Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1
> (519) 824-4120 x56354 (519) 767-1060 FAX (JNHN)
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> "Bad grammar makes me [sic]" - Tshirt
>
>
> ----- Original Message -----
> From: "Wes Sisk" <wsisk[at]cisco.com>
> To: "Ted Nugent" <tednugent73[at]gmail.com>
> Cc: "Cisco VoIPoE List" <cisco-voip[at]puck.nether.net>
> Sent: Monday, October 5, 2009 2:20:09 PM GMT -05:00 US/Canada Eastern
> Subject: Re: [cisco-voip] SyslogSeverityMatchFound on nbslogpd
>
> your CM thanks you.  attempted registration that fails and/or
> auto-registration that fails are very "expensive" processes on CM.
> Addressing failed registration is on our "top 10" things to do when we start
> on a critical account.
>
> /Wes
>
> On Monday, October 05, 2009 10:08:57 AM, Ted Nugent <tednugent73[at]gmail.com>
> wrote:
>
> Thank you sir I know exactly what the problem is now they have 2x vg248s
> which are only half configured pounding on the cluster
>
> On Mon, Oct 5, 2009 at 9:58 AM, Wes Sisk <wsisk[at]cisco.com> wrote:
>>
>> nblogpd - non blocking syslog proxy implemented because the original
>> syslog would go into blocking state which would cause any logging process to
>> also block.  This was bad for ccm process when syslog got too busy.
>>
>> messages were dropped - non blocking syslog implements a buffer.  When
>> buffer is filled faster than it can be written to disk then messages are
>> dropped.
>>
>> how to fix?  take a look at all syslogs (system,security,callmanager) and
>> see what is rapidly/frequently/consistently writing to the logs.  Address
>> why that is happening.
>>
>> historically unconfigured or misconfigured devices have been leading
>> triggers.  They cause transient connection attempts and registration failed
>> messages repeatedly.
>>
>> /Wes
>>
>> On Monday, October 05, 2009 9:54:28 AM, Ted Nugent <tednugent73[at]gmail.com>
>> wrote:
>>
>> After a new cluster upgrade to 7.1.2.31900-1 we're seeing this error
>> logging about every 4-6 hours. I can't seem to find any info on the nbslogpd
>> service? Anyone know what this might be about and how i might fix it? TIA
>>
>> SyslogSeverityMatchFound events generated: SeverityMatch - Alert
>> nbslogpd[13840]: 72 messages were dropped SeverityMatch - Alert
>> nbslogpd[13840]: 2 messages were dropped
>>
>> ________________________________
>> _______________________________________________
>> cisco-voip mailing list
>> cisco-voip[at]puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>
>
>
>
> _______________________________________________ cisco-voip mailing list
> cisco-voip[at]puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
> _______________________________________________
> cisco-voip mailing list
> cisco-voip[at]puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>
>



--
Ed Leatherman
_______________________________________________
cisco-voip mailing list
cisco-voip[at]puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip


rratliff at cisco

Nov 4, 2009, 2:00 PM

Post #8 of 8 (92 views)
Permalink
Re: SyslogSeverityMatchFound on nbslogpd [In reply to]

Go back through Wes' explanation of the nbslogpd. Basically it means
the system was very busy and syslog messages couldn't be written to
disk as fast as they were coming in. During a failover these could be
simple device associations or it could signal that the same disk issue
that affected the ccm process also affected syslog.

-Ryan

On Nov 4, 2009, at 4:46 PM, Ed Leatherman wrote:

Just ran across this thread looking for what the nbslogpd was for..
answered that question :)

Follow-up then.. so if I have an event that causes all the phones on a
subscriber node to fail over to the next CM on the list, I will have
some of these messages in syslog/RTMT alerts and its pretty well
explained why they are here right? about 1500 additional phones would
be failing over to this server inaddition to the 1500ish it already
has to keep track of.

Reason I ask is i'm trying to nail down root cause of the event and I
don't want to go barking up the wrong tree looking at this error.

On Mon, Oct 5, 2009 at 1:23 PM, Lelio Fulgenzi <lelio[at]uoguelph.ca>
wrote:
> and yet our operations team insists (or insisted) on doing just that.
> deleting phones in callmanager before unplugging the phones.
>
> we'll see if it continues now after some changes have been done.
>
>
>
> ---
> Lelio Fulgenzi, B.A.
> Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1
> (519) 824-4120 x56354 (519) 767-1060 FAX (JNHN)
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> "Bad grammar makes me [sic]" - Tshirt
>
>
> ----- Original Message -----
> From: "Wes Sisk" <wsisk[at]cisco.com>
> To: "Ted Nugent" <tednugent73[at]gmail.com>
> Cc: "Cisco VoIPoE List" <cisco-voip[at]puck.nether.net>
> Sent: Monday, October 5, 2009 2:20:09 PM GMT -05:00 US/Canada Eastern
> Subject: Re: [cisco-voip] SyslogSeverityMatchFound on nbslogpd
>
> your CM thanks you. attempted registration that fails and/or
> auto-registration that fails are very "expensive" processes on CM.
> Addressing failed registration is on our "top 10" things to do when
> we start
> on a critical account.
>
> /Wes
>
> On Monday, October 05, 2009 10:08:57 AM, Ted Nugent <tednugent73[at]gmail.com
> >
> wrote:
>
> Thank you sir I know exactly what the problem is now they have 2x
> vg248s
> which are only half configured pounding on the cluster
>
> On Mon, Oct 5, 2009 at 9:58 AM, Wes Sisk <wsisk[at]cisco.com> wrote:
>>
>> nblogpd - non blocking syslog proxy implemented because the original
>> syslog would go into blocking state which would cause any logging
>> process to
>> also block. This was bad for ccm process when syslog got too busy.
>>
>> messages were dropped - non blocking syslog implements a buffer.
>> When
>> buffer is filled faster than it can be written to disk then
>> messages are
>> dropped.
>>
>> how to fix? take a look at all syslogs
>> (system,security,callmanager) and
>> see what is rapidly/frequently/consistently writing to the logs.
>> Address
>> why that is happening.
>>
>> historically unconfigured or misconfigured devices have been leading
>> triggers. They cause transient connection attempts and
>> registration failed
>> messages repeatedly.
>>
>> /Wes
>>
>> On Monday, October 05, 2009 9:54:28 AM, Ted Nugent <tednugent73[at]gmail.com
>> >
>> wrote:
>>
>> After a new cluster upgrade to 7.1.2.31900-1 we're seeing this error
>> logging about every 4-6 hours. I can't seem to find any info on the
>> nbslogpd
>> service? Anyone know what this might be about and how i might fix
>> it? TIA
>>
>> SyslogSeverityMatchFound events generated: SeverityMatch - Alert
>> nbslogpd[13840]: 72 messages were dropped SeverityMatch - Alert
>> nbslogpd[13840]: 2 messages were dropped
>>
>> ________________________________
>> _______________________________________________
>> cisco-voip mailing list
>> cisco-voip[at]puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>
>
>
>
> _______________________________________________ cisco-voip mailing
> list
> cisco-voip[at]puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
> _______________________________________________
> cisco-voip mailing list
> cisco-voip[at]puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>
>



--
Ed Leatherman
_______________________________________________
cisco-voip mailing list
cisco-voip[at]puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

_______________________________________________
cisco-voip mailing list
cisco-voip[at]puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

Cisco voip RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact lists@gossamer-threads.com
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.