Cisco Support Tools 1.0 User Guide How to Use the Log Collector 107
What are Merged Logs?
The Log Collector allows you to create merged logs, logs which combine different
logs from different systems into a single file. Within a merged log, individual log
entries are listed by date and time, allowing you to track, for example, the routing of
an individual call across different ICM systems.
There is no limit to the number of individual system logs that can be included in a
single merged log file. Note however that larger logs will take longer to collect.
When you download a merged log collection, you can download both the individual
associated logs in addition to the merged log itself.
Merge Log Limitations
Merged logs are subject to the following limitations:
To use merged log capabilities, each Support Tools Server and node must be able
to communicate with the same Simple Network Time Protocol (SNTP or NTP)
server. If any system in a merged log collection cannot communicate with the
SNTP server, the merge will fail, and the outputted log will contain the alert:
"Missing SNTP data for all of the following files logs prevented merging logs:..."
For more information, see How to Collect Information for a Support Tools
Installation.
Some logs do not record time in milliseconds: Some logs record events up to the
second, while others record seconds and milliseconds. The Merge logic assumes
zeros when milliseconds are missing.
Even with a properly configured SNTP server, there can be slight drift in time:
Used in conjunction with a properly configured SNTP server, each Support Tools
node tracks deviation between the system clock and the network standard clock.
That difference is used to adjust each log entry. Since time is adjusted in
increments of 8 minutes, minor millisecond differences can occur.
Within a merged log, event ordering can be altered by OS preemption: Within the
same system, processes are pre-empted by the OS. It is possible for ordering in
the log to be affected by OS preemption.
Viewing Entries in Merged Logs
Log entries in merged logs are prefaced by the following identifiers:
ICM Log Entries ICM @ <host_name> + <customer_instance>,
<ICM_node>, <process>: (<utc date/time>)
<local date/time>
CCM Log Entries CCM @ <host_name> + <CCM_node>: >: (<utc
date/time>) <local date/time>