6 Replies Latest reply: Sep 25, 2010 10:13 AM by 807567 RSS

    agent         syntax error in fscan+syslog.dat(1) at token '{'

    807567
      Hello

      I'm getting the following message thousand of times per day.
      Sep 25 13:43:16 [10.64.47.16.183.179] agent[5350]: syslog   Sep 25 13:43:16 agent         syntax error in fscan+syslog.dat(1) at token '{'
      Sep 25 13:43:16 [10.64.47.16.183.179] agent[5350]: syslog   Sep 25 13:43:16 agent         *** aborting execution ***
      Sep 25 13:43:16 [10.64.47.16.183.179] agent[5350]: [ID 886278 daemon.alert] syslog   Sep 25 13:43:16 agent         syntax error in fscan+syslog.dat(1) at token '{'
      Sep 25 13:43:16 [10.64.47.16.183.179] agent[5350]: [ID 362431 daemon.alert] syslog   Sep 25 13:43:16 agent         *** aborting execution ***
      Sep 25 13:44:21 [10.64.47.16.183.179] agent[7778]: syslog   Sep 25 13:44:21 agent         syntax error in fscan+syslog.dat(1) at token '{'
      Sep 25 13:44:21 [10.64.47.16.183.179] agent[7778]: syslog   Sep 25 13:44:21 agent         *** aborting execution ***
      Sep 25 13:44:21 [10.64.47.16.183.179] agent[7778]: [ID 580518 daemon.alert] syslog   Sep 25 13:44:21 agent         syntax error in fscan+syslog.dat(1) at token '{'
      Sep 25 13:44:21 [10.64.47.16.183.179] agent[7778]: [ID 457334 daemon.alert] syslog   Sep 25 13:44:21 agent         *** aborting execution ***
      Sep 25 13:45:27 [10.64.47.16.183.179] agent[10206]: syslog   Sep 25 13:45:27 agent         syntax error in fscan+syslog.dat(1) at token '{'
      Sep 25 13:45:27 [10.64.47.16.183.179] agent[10206]: [ID 275109 daemon.alert] syslog   Sep 25 13:45:27 agent         syntax error in fscan+syslog.dat(1) at token '{'
      Sep 25 13:45:27 [10.64.47.16.183.179] agent[10206]: syslog   Sep 25 13:45:27 agent         *** aborting execution ***
      Sep 25 13:45:27 [10.64.47.16.183.179] agent[10206]: [ID 903135 daemon.alert] syslog   Sep 25 13:45:27 agent         *** aborting execution ***
      Sep 25 13:46:33 [10.64.47.16.183.179] agent[12637]: syslog   Sep 25 13:46:33 agent         syntax error in fscan+syslog.dat(1) at token '{'
      Sep 25 13:46:33 [10.64.47.16.183.179] agent[12637]: [ID 869362 daemon.alert] syslog   Sep 25 13:46:33 agent         syntax error in fscan+syslog.dat(1) at token '{'
      Sep 25 13:46:33 [10.64.47.16.183.179] agent[12637]: syslog   Sep 25 13:46:33 agent         *** aborting execution ***
      Sep 25 13:46:33 [10.64.47.16.183.179] agent[12637]: [ID 622345 daemon.alert] syslog   Sep 25 13:46:33 agent         *** aborting execution ***
      Sep 25 13:47:38 [10.64.47.16.183.179] agent[15065]: syslog   Sep 25 13:47:38 agent         syntax error in fscan+syslog.dat(1) at token '{'
      Sep 25 13:47:38 [10.64.47.16.183.179] agent[15065]: [ID 563921 daemon.alert] syslog   Sep 25 13:47:38 agent         syntax error in fscan+syslog.dat(1) at token '{'
      Sep 25 13:47:38 [10.64.47.16.183.179] agent[15065]: syslog   Sep 25 13:47:38 agent         *** aborting execution ***
      Sep 25 13:47:38 [10.64.47.16.183.179] agent[15065]: [ID 543858 daemon.alert] syslog   Sep 25 13:47:38 agent         *** aborting execution ***
      Any ideas?

      --Andreas                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               
        • 1. Re: agent         syntax error in fscan+syslog.dat(1) at token '{'
          774478
          Hi Andreas,
          Looks like the agent is dying and automatically being restarted by the Solaris 10 SMF services. I am not exactly sure why its dying, but it looks like it has something to do with the File Scanning module. Please try the following:

          01. Stop the agent:
          # /opt/SUNWsymon/sbin/es-stop -a

          02. Edit the base-modules-d.dat file and comment out the File Scanning module (I assume you only loaded one).
          # cd /var/opt/SUNWsymon/cfg
          # cp base-modules-d.dat base-modules-d.dat.BAK
          # vi base-modules-d.dat

          Place a "#" (hash) in front of the line containing "fscan+syslog".

          03. Restart the agent:
          # /opt/SUNWsymon/sbin/es-start -a

          However, you will still want to make use of the File Scanning module. You can try loading it manually and using the "syslog" as an Instance Name parameter. If it dies again, I would be more than happy to look at the logs. Please have a look at our support page on how to run our HALDiag.sh script. Just send it to our experts alias and reference my name, Bobby.
          http://www.halcyoninc.com/support/index.php

          Good Luck!
          Bobby

          http://www.HalcyonInc.com
          http://forums.HalcyonInc.com
          • 2. Re: agent         syntax error in fscan+syslog.dat(1) at token '{'
            807567
            Hello Bobby

            One problem was fixed but now I have a new one :(
            Sep 26 08:18:58 wgtsinf01 agent[1727]: [ID 657200 daemon.alert] syslog   Sep 26 08:18:58 agent         invalid URL mode:
            Sep 26 08:18:58 wgtsinf01 agent[1727]: [ID 968156 daemon.alert] syslog   Sep 26 08:18:58 agent         *** aborting execution ***
            Sep 26 08:18:58 wgtsinf01 agent[1727]: [ID 657200 daemon.alert] syslog   Sep 26 08:18:58 agent         invalid URL mode:
            Sep 26 08:18:58 wgtsinf01 agent[1727]: [ID 968156 daemon.alert] syslog   Sep 26 08:18:58 agent         *** aborting execution ***
            Sep 26 08:19:05 wgtsinf01 agent[3663]: [ID 285625 daemon.alert] syslog   Sep 26 08:19:05 agent         invalid URL mode:
            Sep 26 08:19:05 wgtsinf01 agent[3663]: [ID 285625 daemon.alert] syslog   Sep 26 08:19:05 agent         invalid URL mode:
            Sep 26 08:19:05 wgtsinf01 agent[3663]: [ID 213369 daemon.alert] syslog   Sep 26 08:19:05 agent         *** aborting execution ***
            Sep 26 08:19:05 wgtsinf01 agent[3663]: [ID 213369 daemon.alert] syslog   Sep 26 08:19:05 agent         *** aborting execution ***
            Sep 26 08:19:14 wgtsinf01 agent[7068]: [ID 759446 daemon.alert] syslog   Sep 26 08:19:14 agent         invalid URL mode:
            Sep 26 08:19:14 wgtsinf01 agent[7068]: [ID 759446 daemon.alert] syslog   Sep 26 08:19:14 agent         invalid URL mode:
            Sep 26 08:19:14 wgtsinf01 agent[7068]: [ID 605446 daemon.alert] syslog   Sep 26 08:19:14 agent         *** aborting execution ***
            Sep 26 08:19:14 wgtsinf01 agent[7068]: [ID 605446 daemon.alert] syslog   Sep 26 08:19:14 agent         *** aborting execution ***
            Sep 26 08:19:22 wgtsinf01 agent[8792]: [ID 212727 daemon.alert] syslog   Sep 26 08:19:22 agent         invalid URL mode:
            Sep 26 08:19:22 wgtsinf01 agent[8792]: [ID 473235 daemon.alert] syslog   Sep 26 08:19:22 agent         *** aborting execution ***
            Sep 26 08:19:22 wgtsinf01 agent[8792]: [ID 212727 daemon.alert] syslog   Sep 26 08:19:22 agent         invalid URL mode:
            Sep 26 08:19:22 wgtsinf01 agent[8792]: [ID 473235 daemon.alert] syslog   Sep 26 08:19:22 agent         *** aborting execution ***
            Any more ideas?

            Cheers,
            --Andreas                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               
            • 3. Re: agent         syntax error in fscan+syslog.dat(1) at token '{'
              774478
              Hi Andreas,
              It's hard to tell, I have never really come across this type of error before. I wonder if some files are missing and causing the agent to abort. Can you try re-installing the agent or if you would like me to investigate further, please send me the output of our HALDiag.sh script.

              http://www.halcyoninc.com/support/index.php

              thanks
              bobby
              • 4. Re: agent         syntax error in fscan+syslog.dat(1) at token '{'
                774478
                Hi Andreas,
                Just wondering if you were able to solve the problem with the reinstall? I have some free cycles to try and assist. Feel free to send the output of HALDiag.sh to Halcyon Support.

                bobby
                http://www.HalcyonInc.com
                • 5. Re: agent         syntax error in fscan+syslog.dat(1) at token '{'
                  807567
                  Yes, thanks. Problem resolved. I used the same idea above with other configuration files and now, at least, I do not have this message. As soon we have more time (yeah, right!) we are going back to work on this idea.

                  Thanks again
                  -- Andreas
                  • 6. Re: agent         syntax error in fscan+syslog.dat(1) at token '{'
                    807567
                    Seems the problem was created by */var/opt/SUNWsymon/cfg/domain-config.x*. All entries for IP addresses were wrong.
                    # cat domain-config.x 
                    trap = {
                            trapServer = "127.0.0.1"
                            logicalAddressMode = "ip"
                            snmpPort = "162"
                    }
                    event = {
                            eventServer = "127.0.0.1"
                            logicalAddressMode = "ip"
                            snmpPort = "163"
                    }
                    agent = {
                            agentServer = "10.64.7.20"
                            logicalAddressMode = "ip"
                            snmpPort = "1161"
                            historyOutput = "clog://localhost/../log/history.log;lines=12000;width=200;flags=rw+;mode=644;mmap=false"
                    }
                    platform = {
                            platformServer = "10.64.7.20"
                            logicalAddressMode = "ip"
                            snmpPort = "166"
                            historyOutput = "clog://localhost/../log/history.log;lines=12000;width=200;flags=rw+;mode=644;mmap=false"
                    }
                    security = {
                            privOID = "1.3.6.1.6.3.10.1.2.2"
                    }