Help Center

Threshold - Syslog-CUCM

Properties

Nodes to Run On: #DefaultNode

Threshold Conditions

Cucm_DRFBackupDevErr

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND ( CMNEM = "CiscoDRFDeviceError" OR CMNEM = "DRFBackupDeviceError")

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Check if the proper device has been specified in the DB / DRF configurations.
Check if the disk is full or tape is not online.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: DRF Backup process is failed due to backup device error.

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: DRF Backup process is failed due to backup device error.

Severity

 Warning

Cucm_DRFBackupFail

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND (CMNEM = "CiscoDRFBackupFailure" OR CMNEM = "DRFBackupFailure")

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Check if the disk is full or tape is not online.
Plus check DRF logs for further details.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: DRF Backup process encountered errors

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: DRF Backup process encountered errors

Severity

 Warning

Cucm_DRFFailure

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "DRFFailure"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Check DRF logs for further details.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: DRF Backup or Restore process encountered errors.

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: DRF Backup or Restore process encountered errors.

Severity

 Warning

Cucm_DRFInternalProcFail

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND ( CMNEM = "CiscoDRFInternalProcessFailure" OR CMNEM = "DRFInternalProcessFailure")

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Check the reason code in the assocaited syslog message, DRF logs and restart Master Agent if necessary.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: @SYSLOG.MESSAGE1@@SYSLOG.MESSAGE2@

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: @SYSLOG.MESSAGE1@@SYSLOG.MESSAGE2@

Severity

 Warning

Cucm_DRFMABackupCompFail

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "DRFMABackupComponentFailure"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

DRF requested a component to backup its' data. However, there was an error during the backup process
and the component was not backed up.Please check the component backup logs and contact support if needed.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: DRF was unable to backup at least one component.

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: DRF was unable to backup at least one component.

Severity

 Warning

Cucm_DRFMABackupNodeDis

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "DRFMABackupNodeDisconnect"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

The DRF Master Agent was running a backup operation on a CCM cluster, when one of the nodes
disconnected before the backup operation was completed. Please check the computer that disconnected
during backup. If the computer was accidentally shutdown, restart the backup.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: The node being backed up disconnected from the Master Agent prior to being fully backed up.

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: The node being backed up disconnected from the Master Agent prior to being fully backed up.

Severity

 Warning

Cucm_DRFMsterAgStartFail

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND ( CMNEM = "CiscoDRFMasterAgentStartFailure" OR CMNEM = "DRFMasterAgentStartFailure")

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

DRF Master Agent was unable to start because it was unable to open port 4040.
Check if the Master Agent is running or port 4040 is already in use.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: DRF Master Agent was not able to start.

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: DRF Master Agent was not able to start.

Severity

 Warning

Cucm_DRFNoBackupTaken

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "DRFNoBackupTaken"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

It is recommended to perform a Backup using the Disaster Recovery System.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: A valid backup of the current system was not found after an Upgarde/Migration or Fresh Install.

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: A valid backup of the current system was not found after an Upgarde/Migration or Fresh Install.

Severity

 Warning

Cucm_DRFSftpFailure

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "DRFSftpFailure"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Ensure that the destination server is available, has appropriate permissions and sftp daemon is running.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@:DRF sftp operation has failed.

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@:DRF sftp operation has failed.

Severity

 Warning

Cucm_ElmNotConnected

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "CiscoElmNotConnected"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

The Cisco Unified Communications Manager system has not synchronized successfully to the Enterprise License Manager.
Check if Enterprise License Manager is connected properly.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: Enterprise License Manager Not Connected.

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: Enterprise License Manager Not Connected.

Severity

 Warning

Cucm_GraceTimeLeft

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "CiscoGraceTimeLeft"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Upload additional licenses to Enterprise License Manager.
Verify that Enterprise License Manager is connected to the Cisco Unified Communications Manager.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: Grace period countdown towards no provisioning allowed.

Severity

 Information

SNMP Trap

Message

@SYSLOG.CLUSTER@: Grace period countdown towards no provisioning allowed.

Severity

 Information

Cucm_NoProvisionTimeout

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "CiscoNoProvisionTimeout"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

The system is operating with an insufficient number of licenses.
Configure additional licenses in your Enterprise License Manager in
order to restore the ability to provision users and devices.
Check if Enterprise License Manager is connected to the product.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: The grace period for licensing has expired .

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: The grace period for licensing has expired .

Severity

 Warning

Cucm_PushNAccessTInv

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND (CMNEM = "AccessTokenInvalid" AND CFAC ="UC_CPNS")

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

The current access token for Cisco Push Notification Service has expired and a new access token is not available.
This alarm indicates that current access token is expired or has become invalid and the token refresh process has not been successful.
Verify that the Cloud Onboarding is completed on Cloud Onboarding page. If using an HTTP Proxy verify the configuration on the Cloud Onboarding page.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: The current access token for Cisco Push Notification Service has expired and a new access token is not available.

Severity

 Critical

SNMP Trap

Message

@SYSLOG.CLUSTER@: The current access token for Cisco Push Notification Service has expired and a new access token is not available.

Severity

 Critical

Cucm_PushNAccessTUnavail

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND ( CMNEM = "PushNotificationServiceAccessTokenUnavailable")

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Cisco Unified Communications Manager requires a valid access token to send push notifications to the Cisco Collaboration Cloud. This access token is currently not available due to an authentication or network error.

Reason code can be one of the following:
0 Access token is not available due to unknown reason
400 invalid_request, unsupported_grant_type, invalid_client, invalid_refresh_token, tokenlimit_reached
401 invalid refresh_guid
405 Method Not Allowed
413 Payload too large
500 Internal Server Error
503 Service unavailable

Check on the Cloud Onboarding page to confirm that the Onboarding process has completed successfully. If the issue persists contact Cisco TAC for further assistance.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: Cisco Push Notification Service (CPNS) does not have a valid Access Token

Severity

 Critical

SNMP Trap

Message

@SYSLOG.CLUSTER@: Cisco Push Notification Service (CPNS) does not have a valid Access Token

Severity

 Critical

Cucm_PushNHttpCPCErr

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND (CMNEM = "HttpClientPoolCreationError" AND CFAC ="UC_CPNS")

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

This alarm indicates that creation of the Http Client connection pool encountered an error.
On the Cisco Cloud Onboarding Configuration page verify any HTTP proxy settings are correct and that the on-boarding process has completed. Try restarting the Cisco Push Notification Service.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: An error occurr in creating the Http Client connection pool for Cisco Push Notification Service

Severity

 Critical

SNMP Trap

Message

@SYSLOG.CLUSTER@: An error occurr in creating the Http Client connection pool for Cisco Push Notification Service

Severity

 Critical

Cucm_PushNServStartF

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND (CMNEM = "StartFailed" AND CFAC ="UC_CPNS")

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

An internal failure is preventing the Cisco Push Notification Service from starting.
Try restarting Cisco Push Notification service. If the issue persists check the application logs for the CPNS service and contact Cisco TAC for further assistance.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: A failure occured while starting the Cisco Push Notification Service (CPNS)

Severity

 Error

SNMP Trap

Message

@SYSLOG.CLUSTER@: A failure occured while starting the Cisco Push Notification Service (CPNS)

Severity

 Error

Cucm_PushNServUnavail

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND ( CMNEM = "PushNotificationServiceUnavailable")

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

The Cisco CallManager service requires a connection with CPNS to send Push Notifications to the Cisco Collaboration Cloud. The connection with CPNS is not established or has been lost due to a service error.
Check if the Cisco Push Notification Service is running. If the CPNS is not running, start it. If it is already running, try re-starting the service.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: Unable to connect with local Cisco Push Notification Service (CPNS)

Severity

 Critical

SNMP Trap

Message

@SYSLOG.CLUSTER@: Unable to connect with local Cisco Push Notification Service (CPNS)

Severity

 Critical

Cucm_SIPTrunkISV

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "SIPTrunkISV"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Notification purpose only. No action is required
All remote peers are available to handle calls for this SIP trunk.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: @SYSLOG.MESSAGE1@

Severity

 Information

SNMP Trap

Message

@SYSLOG.CLUSTER@: @SYSLOG.MESSAGE1@

Severity

 Information

Cucm_SIPTrunkOOS

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "SIPTrunkOOS"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

All remote peers for this SIP trunk are out of service and unable to handle calls.
Look up the syslog message if the entire content is not visible within the alert.
It should provide the reason code received by the SIP trunk in response to an Options request sent to the remote peer.
The list of unavailable remote peers is provided in this syslog message and
each peer is separated by semi-colon. For each peer, the message provides the hostname
or SRV (if configured on SIP trunk), resolved IP address, port number, and reason
code in the following format: ReasonCodeType=ReasonCode. ReasonCodeType could be based
on a SIP response from the remote peer as defined in SIP RFCs (Remote) or based
on a reason code provided by Unified CM (Local). Examples of possible reason codes include
Remote=503 ("503 Service Unavailable" a standard SIP RFC error code),
Remote=408 ("408 Request Timeout" a standard SIP RFC error code),
Local=1 (request timeout),
Local=2 (local SIP stack is not able to create a socket connection with the remote peer),
Local=3 (DNS query failed). For Local=3, IP address in message will be represented as 0
and when dns srv is configured on SIP trunk then port will be represented as 0.
Following information provided on System Error Messages for Cisco Unified Communications
Manager using the reason codes in the message.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: @SYSLOG.MESSAGE1@@SYSLOG.MESSAGE2@

Severity

 Error

SNMP Trap

Message

@SYSLOG.CLUSTER@: @SYSLOG.MESSAGE1@@SYSLOG.MESSAGE2@

Severity

 Error

Cucm_SIPTrunkPartialISV

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "SIPTrunkPartiallyISV"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Some of the remote peers are not available to handle calls for this SIP trunk.
Look up the syslog message if the entire content is not visible within the alert.
It should provide a list of available remote peers and a list of unavailable
remote peers and each peer is separated by semi-colon.
Available peer list is for notification purpose only; no action is required.
For each unavailable peer, the message provides the hostname
or SRV (if configured on SIP trunk), resolved IP address, port number, and reason
code in the following format: ReasonCodeType=ReasonCode. ReasonCodeType could be based
on a SIP response from the remote peer as defined in SIP RFCs (Remote) or based
on a reason code provided by Unified CM (Local). Examples of possible reason codes include
Remote=503 ("503 Service Unavailable" a standard SIP RFC error code),
Remote=408 ("408 Request Timeout" a standard SIP RFC error code),
Local=1 (request timeout),
Local=2 (local SIP stack is not able to create a socket connection with the remote peer),
Local=3 (DNS query failed). For Local=3, IP address in message will be represented as 0
and when dns srv is configured on SIP trunk then port will be represented as 0.
Following information provided on System Error Messages for Cisco Unified Communications
Manager using the reason codes in the message."

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: @SYSLOG.MESSAGE1@@SYSLOG.MESSAGE2@

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: @SYSLOG.MESSAGE1@@SYSLOG.MESSAGE2@

Severity

 Warning

Cucm_SLMAuthExpSoon

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "SmartLicenseAuthorizationExpiringSoon"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Please initiate an authorization renewal using 'Renew Authorization Now' from the License Management web page
or 'license smart renew auth' from the CLI before the authorization period expires.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: Product license authorization period will expire soon.

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: Product license authorization period will expire soon.

Severity

 Warning

Cucm_SLMCommErr

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "SmartLicenseCommunicationError"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Please verify that the system has network connectivity to Cisco Smart Software Manager or satellite.
If you are unable to resolve the issue contact TAC for assistance.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: Product failed to communicate with Cisco Smart Software Manager.

Severity

 Error

SNMP Trap

Message

@SYSLOG.CLUSTER@: Product failed to communicate with Cisco Smart Software Manager.

Severity

 Error

Cucm_SLMInEval

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "SmartLicenseInEval"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

The system is not registered with Cisco Smart Software Manager or satellite and is operating in Evaluation Mode.
Register the system with Cisco Smart Software Manager or satellite.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: The Product is operating in Evaluation Mode that will expire soon.

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: The Product is operating in Evaluation Mode that will expire soon.

Severity

 Warning

Cucm_SLMInOver_Auth

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "SmartLicenseInOverage_AuthorizationExpired"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Please check the network connection and renew the license authorization to avoid losing the ability to provision users and devices.
The system has not communicated with Cisco Smart Software Manager or satellite for 90 days and the overage
period is active. Provisioning of users and devices will not be allowed if a successful license authorization
renewal is not done within the overage days left.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: The Product Smart license authorization has expired and is currently running on overage period.

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: The Product Smart license authorization has expired and is currently running on overage period.

Severity

 Warning

Cucm_SLMInOver_OOC

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "SmartLicenseInOverage_OutOfCompliance"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

The system is operating with an insufficient number of licenses and the overage period is active.
Configure additional licenses in Cisco Smart Software Manager to avoid losing the ability to provision users and devices.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: Product is operating with insufficient number of licenses.

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: Product is operating with insufficient number of licenses.

Severity

 Warning

Cucm_SLMNP_Auth

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "SmartLicenseNoProvision_AuthorizationExpired"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Please check the network connection and renew the license authorization in order to restore the ability to provision users and devices.
The system has not communicated with Cisco Smart Software Manager or satellite for 90 days and the system
has not automatically renewed the entitlement authorizations. Provisioning of users and devices is no longer allowed.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: Product license authorization has expired. You will not be allowed to provision users or devices.

Severity

 Error

SNMP Trap

Message

@SYSLOG.CLUSTER@: Product license authorization has expired. You will not be allowed to provision users or devices.

Severity

 Error

Cucm_SLMNP_Eval

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "SmartLicenseNoProvision_EvalExpired"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Register the system with Cisco Smart Software Manager or satellite in order to restore the ability to provision users and devices.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: The Product Smart Licensing evaluation period has expired. You will not be allowed to provision users and devices.

Severity

 Error

SNMP Trap

Message

@SYSLOG.CLUSTER@: The Product Smart Licensing evaluation period has expired. You will not be allowed to provision users and devices.

Severity

 Error

Cucm_SLMNP_OOC

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "SmartLicenseNoProvision_OutOfCompliance"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Configure additional licenses in Cisco Smart Software Manager in order to restore the ability to provision users and devices.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: The system is operating with insufficient number of licenses. You will not be allowed to provision users and devices.

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: The system is operating with insufficient number of licenses. You will not be allowed to provision users and devices.

Severity

 Warning

Cucm_SLMRegExp

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "SmartLicenseRegistrationExpired"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

The current time is outside the valid registration period in the ID certificate and the license registration has expired.
This could be caused by a change in the system clock or multiple communication failures with Cisco Smart Software
Manager or satellite. Please check the network connectivity to Cisco Smart Software Manager or satellite.
Also verify your system clock is correct and then register the system with Cisco Smart Software Manager or satellite.
If the operation still fails, collect traces for Cisco Smart License Manager using the CLI command
file get activelog /cm/trace/slm/log4j/.
If you are unable to resolve the issue contact TAC for assistance.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: Product license registration has expired and product is unregistered with Cisco Smart Software Manager.

Severity

 Error

SNMP Trap

Message

@SYSLOG.CLUSTER@: Product license registration has expired and product is unregistered with Cisco Smart Software Manager.

Severity

 Error

Cucm_SLMRegExpSoon

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "SmartLicenseRegistrationExpiringSoon"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Please initiate a registration renewal using 'Renew Registration Now' from the License Management web page or
'license smart renew ID' from the CLI. If a successful renewal is not done before the registration period expires,
you will not be allowed to provision users or devices.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: Product registration with Cisco Smart Software Manager will expire soon.

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: Product registration with Cisco Smart Software Manager will expire soon.

Severity

 Warning

Cucm_SLMRenAuthFail

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "SmartLicenseRenewAuthFailed"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Please retry an authorization renewal using 'Renew Authorization Now'
from the License Management web page or 'license smart renew auth' from the CLI.
If the operation still fails, collect traces for Cisco Smart License Manager using the CLI
command file get activelog /cm/trace/slm/log4j/. If you are unable to resolve the issue
contact TAC for assistance.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: Product license authorization renewal failed.

Severity

 Error

SNMP Trap

Message

@SYSLOG.CLUSTER@: Product license authorization renewal failed.

Severity

 Error

Cucm_SLMRenRegFail

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "SmartLicenseRenewRegistrationFailed"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Please retry a registration renewal using 'Renew Registration Now' from the License Management
web page or 'license smart renew ID' from the CLI. If the operation still fails, collect traces for Cisco
Smart License Manager using the CLI ommand file get activelog /cm/trace/slm/log4j/.
If you are unable to resolve the issue contact TAC for assistance.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: Product license registration renewal failed.

Severity

 Error

SNMP Trap

Message

@SYSLOG.CLUSTER@: Product license registration renewal failed.

Severity

 Error

Cucm_SystemInOverage

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "CiscoSystemInOverage"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Upload additional licenses.
Verify that Enterprise License Manager is connected to the product.
The system is operating with an insufficient number of licenses.
If additional licenses to cover the shortage are not configured in your Enterprise License Manager within a few days,
you will no longer be able to provision users and devices.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: System is in overage which means licensed resource limit has been exceeded on the system.

Severity

 Warning

SNMP Trap

Message

@SYSLOG.CLUSTER@: System is in overage which means licensed resource limit has been exceeded on the system.

Severity

 Warning

Cucm_SystemSecurityMisma

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "CiscoSystemSecurityMismatch"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Verify Enterprise License Manager certificates.
This could be a man-in-the-middle attack

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: Certificate Mismatch between Cisco Unified Communications Manager and Enterprise LicenseManager.

Severity

 Error

SNMP Trap

Message

@SYSLOG.CLUSTER@: Certificate Mismatch between Cisco Unified Communications Manager and Enterprise LicenseManager.

Severity

 Error

Cucm_SystemTimeChange

Where Clause:

CFAC <> EMPTY AND TYPE = "C5" AND CMNEM = "CiscoSystemTimeChange"

Alarm Interval:

Every30 Second(s)

Nodes to Monitor:

#CurrentNode

Record:

SYSLOG

Recommended action:

Determine why the system time changed if it is unexpected.

Message Destinations:

Problem Summary

Event No

0

Message

@SYSLOG.CLUSTER@: System time has changed.

Severity

 Information

SNMP Trap

Message

@SYSLOG.CLUSTER@: System time has changed.

Severity

 Information

Provide feedback on this article