15-12
User Guide for Cisco Secure Access Control System 5.4
OL-26225-01
Chapter15 Managing System Operations and Configuration in the Monitoring and Report Viewer
Recovering Log Messages
Recovering Log Messages
ACS server sends syslog messages to the Monitoring and Report Viewer for the activities such as passed
authentication, failed attempts, authorization, accounting, and so on.
The syslog messages have a sequence number attached. If the Monitoring and Report Viewer goes down
or if it is not able to receive messages from ACS, then the Monitoring and Report Viewer retries those
missed logs from ACS, using the logging recovery mechanism.
The Monitoring and Report Viewer processes the syslog messages, and identifies any discrepancies in
the sequence. In this way, it finds the messages that have been missed.
The Monitoring and Report Viewer then notifies the ACS server to resend the missing log messages.
ACS server processes the messages stored in its local store and resends them to the Monitoring and
Report Viewer.
Note For the Recovering Log Messages feature to work as desired, you must enable the Log to Local Target
option for the relevant logging categories in ACS under System Administration > Configuration > Log
Configuration > Logging Categories > Global.
To enable Recovering Log Messages, from the Monitoring and Report Viewer, select Monitoring
Configuration > System Operations > Log Message Recovery.
Note View logging recovery will not retrieve the missed logs when the View Logging Recovery feature is
disabled and the view is down.
Viewing Scheduled Jobs
Use this page to view the scheduled jobs.
From the Monitoring and Report Viewer, select Monitoring Configuration > System Operations >
Scheduler.
Table15-5 Log Message Recovery Page
Option Description
Log Message Recovery Option
On Enable the log message recovery feature.
Off Disable the log message recovery feature.
Configure Log Message Recovery Intervals
Run Every Minute(s) Set the duration in minutes, at which the recovery should happen.
Run Every Hour(s) Set the duration in hours, at which the recovery should happen.
Configure Missing Entry count to be re-sent by Collector
No.of Missing Entries to
be re-sent by Collector
during recovery at a time
Maximum number of missing entries that can be sent by the ACS server at a time.The default
limit is 1000 and the maximum limit is 9999. If you set value higher than this, ACS performance
might go down.