Cisco Systems 1.0 (1) manual What are Merged Logs?, Merge Log Limitations

What are Merged Logs?

The Log Collector allows you to create merged logs, logs which combine different logs from different systems into a single file. Within a merged log, individual log entries are listed by date and time, allowing you to track, for example, the routing of an individual call across different ICM systems.

There is no limit to the number of individual system logs that can be included in a single merged log file. Note however that larger logs will take longer to collect.

When you download a merged log collection, you can download both the individual associated logs in addition to the merged log itself.

Merge Log Limitations

Merged logs are subject to the following limitations:

•To use merged log capabilities, each Support Tools Server and node must be able to communicate with the same Simple Network Time Protocol (SNTP or NTP) server. If any system in a merged log collection cannot communicate with the SNTP server, the merge will fail, and the outputted log will contain the alert: "Missing SNTP data for all of the following files logs prevented merging logs:..."

For more information, see How to Collect Information for a Support Tools Installation.

•Some logs do not record time in milliseconds: Some logs record events up to the second, while others record seconds and milliseconds. The Merge logic assumes zeros when milliseconds are missing.

•Even with a properly configured SNTP server, there can be slight drift in time: Used in conjunction with a properly configured SNTP server, each Support Tools node tracks deviation between the system clock and the network standard clock. That difference is used to adjust each log entry. Since time is adjusted in increments of 8 minutes, minor millisecond differences can occur.

•Within a merged log, event ordering can be altered by OS preemption: Within the same system, processes are pre-empted by the OS. It is possible for ordering in the log to be affected by OS preemption.

Viewing Entries in Merged Logs

Log entries in merged logs are prefaced by the following identifiers:

ICM Log Entries

CCM Log Entries

ICM @ <host_name> + <customer_instance>, <ICM_node>, <process>: (<utc date/time>) <local date/time>

CCM @ <host_name> + <CCM_node>: >: (<utc date/time>) <local date/time>

Cisco Support Tools 1.0 User Guide How to Use the Log Collector 107