Cisco Systems 2.1(1) manual What are Merged Logs?, 118

Chapter 11: - Using Support Tools Utilities from the Dashboard

About Log Collection

file, or delivered as individual files. You define when you want the logs collected by specifying a start and end time.

Each log collection request can be run only once. The logs it collects are stored in the Repository where they remain until you choose to delete them (by deleting the log collection to which they belong). Collected logs can be downloaded locally for viewing.

What are Merged Logs?

The Collect Logs Screen allows you to create merged logs, logs which combine different logs from different systems into a single file. Within a merged log, individual log entries are listed by date and time, allowing you to track, for example, the routing of an individual call across different ICM systems.

There is no limit to the number of individual system logs that can be included in a single merged log file. Note however that larger logs will take longer to collect.

When you download a merged log collection, you can download both the individual associated logs in addition to the merged log itself.

Merged logs are subject to the following limitations:

•To use merged log capabilities, each Support Tools Server and node must be able to communicate with the same Simple Network Time Protocol (SNTP or NTP) server. If any system in a merged log collection cannot communicate with the SNTP server, the merge will fail, and the outputted log will contain the alert: "Missing SNTP data for all of the following files logs prevented merging logs:..."

•Some logs do not record time in milliseconds: Some logs record events up to the second, while others record seconds and milliseconds. The Merge logic assumes zeros when milliseconds are missing.

•Even with a properly configured SNTP server, there can be slight drift in time: Used in conjunction with a properly configured SNTP server, each Support Tools node tracks deviation between the system clock and the network standard clock. That difference is used to adjust each log entry. Since time is adjusted in increments of 8 minutes, minor millisecond differences can occur.

•Within a merged log, event ordering can be altered by OS pre-emotion: Within the same system, processes are pre-empted by the OS. It is possible for ordering in the log to be affected by OS preemption.

•A Merged Log Collection must span a time greater than the time server sample interval across all included nodes to be collected.

Log entries in merged logs are prefaced by the following identifiers:

Cisco Support Tools User Guide for Cisco Unified Software Release 2.1(1)

118