This discussion is archived
6 Replies Latest reply: Sep 25, 2010 8:13 AM by 807567 RSS

agent         syntax error in fscan+syslog.dat(1) at token '{'

807567 Newbie
Currently Being Moderated
Hello

I'm getting the following message thousand of times per day.
Sep 25 13:43:16 [10.64.47.16.183.179] agent[5350]: syslog   Sep 25 13:43:16 agent         syntax error in fscan+syslog.dat(1) at token '{'
Sep 25 13:43:16 [10.64.47.16.183.179] agent[5350]: syslog   Sep 25 13:43:16 agent         *** aborting execution ***
Sep 25 13:43:16 [10.64.47.16.183.179] agent[5350]: [ID 886278 daemon.alert] syslog   Sep 25 13:43:16 agent         syntax error in fscan+syslog.dat(1) at token '{'
Sep 25 13:43:16 [10.64.47.16.183.179] agent[5350]: [ID 362431 daemon.alert] syslog   Sep 25 13:43:16 agent         *** aborting execution ***
Sep 25 13:44:21 [10.64.47.16.183.179] agent[7778]: syslog   Sep 25 13:44:21 agent         syntax error in fscan+syslog.dat(1) at token '{'
Sep 25 13:44:21 [10.64.47.16.183.179] agent[7778]: syslog   Sep 25 13:44:21 agent         *** aborting execution ***
Sep 25 13:44:21 [10.64.47.16.183.179] agent[7778]: [ID 580518 daemon.alert] syslog   Sep 25 13:44:21 agent         syntax error in fscan+syslog.dat(1) at token '{'
Sep 25 13:44:21 [10.64.47.16.183.179] agent[7778]: [ID 457334 daemon.alert] syslog   Sep 25 13:44:21 agent         *** aborting execution ***
Sep 25 13:45:27 [10.64.47.16.183.179] agent[10206]: syslog   Sep 25 13:45:27 agent         syntax error in fscan+syslog.dat(1) at token '{'
Sep 25 13:45:27 [10.64.47.16.183.179] agent[10206]: [ID 275109 daemon.alert] syslog   Sep 25 13:45:27 agent         syntax error in fscan+syslog.dat(1) at token '{'
Sep 25 13:45:27 [10.64.47.16.183.179] agent[10206]: syslog   Sep 25 13:45:27 agent         *** aborting execution ***
Sep 25 13:45:27 [10.64.47.16.183.179] agent[10206]: [ID 903135 daemon.alert] syslog   Sep 25 13:45:27 agent         *** aborting execution ***
Sep 25 13:46:33 [10.64.47.16.183.179] agent[12637]: syslog   Sep 25 13:46:33 agent         syntax error in fscan+syslog.dat(1) at token '{'
Sep 25 13:46:33 [10.64.47.16.183.179] agent[12637]: [ID 869362 daemon.alert] syslog   Sep 25 13:46:33 agent         syntax error in fscan+syslog.dat(1) at token '{'
Sep 25 13:46:33 [10.64.47.16.183.179] agent[12637]: syslog   Sep 25 13:46:33 agent         *** aborting execution ***
Sep 25 13:46:33 [10.64.47.16.183.179] agent[12637]: [ID 622345 daemon.alert] syslog   Sep 25 13:46:33 agent         *** aborting execution ***
Sep 25 13:47:38 [10.64.47.16.183.179] agent[15065]: syslog   Sep 25 13:47:38 agent         syntax error in fscan+syslog.dat(1) at token '{'
Sep 25 13:47:38 [10.64.47.16.183.179] agent[15065]: [ID 563921 daemon.alert] syslog   Sep 25 13:47:38 agent         syntax error in fscan+syslog.dat(1) at token '{'
Sep 25 13:47:38 [10.64.47.16.183.179] agent[15065]: syslog   Sep 25 13:47:38 agent         *** aborting execution ***
Sep 25 13:47:38 [10.64.47.16.183.179] agent[15065]: [ID 543858 daemon.alert] syslog   Sep 25 13:47:38 agent         *** aborting execution ***
Any ideas?

--Andreas                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               
  • 1. Re: agent         syntax error in fscan+syslog.dat(1) at token '{'
    774478 Newbie
    Currently Being Moderated
    Hi Andreas,
    Looks like the agent is dying and automatically being restarted by the Solaris 10 SMF services. I am not exactly sure why its dying, but it looks like it has something to do with the File Scanning module. Please try the following:

    01. Stop the agent:
    # /opt/SUNWsymon/sbin/es-stop -a

    02. Edit the base-modules-d.dat file and comment out the File Scanning module (I assume you only loaded one).
    # cd /var/opt/SUNWsymon/cfg
    # cp base-modules-d.dat base-modules-d.dat.BAK
    # vi base-modules-d.dat

    Place a "#" (hash) in front of the line containing "fscan+syslog".

    03. Restart the agent:
    # /opt/SUNWsymon/sbin/es-start -a

    However, you will still want to make use of the File Scanning module. You can try loading it manually and using the "syslog" as an Instance Name parameter. If it dies again, I would be more than happy to look at the logs. Please have a look at our support page on how to run our HALDiag.sh script. Just send it to our experts alias and reference my name, Bobby.
    http://www.halcyoninc.com/support/index.php

    Good Luck!
    Bobby

    http://www.HalcyonInc.com
    http://forums.HalcyonInc.com
  • 2. Re: agent         syntax error in fscan+syslog.dat(1) at token '{'
    807567 Newbie
    Currently Being Moderated
    Hello Bobby

    One problem was fixed but now I have a new one :(
    Sep 26 08:18:58 wgtsinf01 agent[1727]: [ID 657200 daemon.alert] syslog   Sep 26 08:18:58 agent         invalid URL mode:
    Sep 26 08:18:58 wgtsinf01 agent[1727]: [ID 968156 daemon.alert] syslog   Sep 26 08:18:58 agent         *** aborting execution ***
    Sep 26 08:18:58 wgtsinf01 agent[1727]: [ID 657200 daemon.alert] syslog   Sep 26 08:18:58 agent         invalid URL mode:
    Sep 26 08:18:58 wgtsinf01 agent[1727]: [ID 968156 daemon.alert] syslog   Sep 26 08:18:58 agent         *** aborting execution ***
    Sep 26 08:19:05 wgtsinf01 agent[3663]: [ID 285625 daemon.alert] syslog   Sep 26 08:19:05 agent         invalid URL mode:
    Sep 26 08:19:05 wgtsinf01 agent[3663]: [ID 285625 daemon.alert] syslog   Sep 26 08:19:05 agent         invalid URL mode:
    Sep 26 08:19:05 wgtsinf01 agent[3663]: [ID 213369 daemon.alert] syslog   Sep 26 08:19:05 agent         *** aborting execution ***
    Sep 26 08:19:05 wgtsinf01 agent[3663]: [ID 213369 daemon.alert] syslog   Sep 26 08:19:05 agent         *** aborting execution ***
    Sep 26 08:19:14 wgtsinf01 agent[7068]: [ID 759446 daemon.alert] syslog   Sep 26 08:19:14 agent         invalid URL mode:
    Sep 26 08:19:14 wgtsinf01 agent[7068]: [ID 759446 daemon.alert] syslog   Sep 26 08:19:14 agent         invalid URL mode:
    Sep 26 08:19:14 wgtsinf01 agent[7068]: [ID 605446 daemon.alert] syslog   Sep 26 08:19:14 agent         *** aborting execution ***
    Sep 26 08:19:14 wgtsinf01 agent[7068]: [ID 605446 daemon.alert] syslog   Sep 26 08:19:14 agent         *** aborting execution ***
    Sep 26 08:19:22 wgtsinf01 agent[8792]: [ID 212727 daemon.alert] syslog   Sep 26 08:19:22 agent         invalid URL mode:
    Sep 26 08:19:22 wgtsinf01 agent[8792]: [ID 473235 daemon.alert] syslog   Sep 26 08:19:22 agent         *** aborting execution ***
    Sep 26 08:19:22 wgtsinf01 agent[8792]: [ID 212727 daemon.alert] syslog   Sep 26 08:19:22 agent         invalid URL mode:
    Sep 26 08:19:22 wgtsinf01 agent[8792]: [ID 473235 daemon.alert] syslog   Sep 26 08:19:22 agent         *** aborting execution ***
    Any more ideas?

    Cheers,
    --Andreas                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               
  • 3. Re: agent         syntax error in fscan+syslog.dat(1) at token '{'
    774478 Newbie
    Currently Being Moderated
    Hi Andreas,
    It's hard to tell, I have never really come across this type of error before. I wonder if some files are missing and causing the agent to abort. Can you try re-installing the agent or if you would like me to investigate further, please send me the output of our HALDiag.sh script.

    http://www.halcyoninc.com/support/index.php

    thanks
    bobby
  • 4. Re: agent         syntax error in fscan+syslog.dat(1) at token '{'
    774478 Newbie
    Currently Being Moderated
    Hi Andreas,
    Just wondering if you were able to solve the problem with the reinstall? I have some free cycles to try and assist. Feel free to send the output of HALDiag.sh to Halcyon Support.

    bobby
    http://www.HalcyonInc.com
  • 5. Re: agent         syntax error in fscan+syslog.dat(1) at token '{'
    807567 Newbie
    Currently Being Moderated
    Yes, thanks. Problem resolved. I used the same idea above with other configuration files and now, at least, I do not have this message. As soon we have more time (yeah, right!) we are going back to work on this idea.

    Thanks again
    -- Andreas
  • 6. Re: agent         syntax error in fscan+syslog.dat(1) at token '{'
    807567 Newbie
    Currently Being Moderated
    Seems the problem was created by */var/opt/SUNWsymon/cfg/domain-config.x*. All entries for IP addresses were wrong.
    # cat domain-config.x 
    trap = {
            trapServer = "127.0.0.1"
            logicalAddressMode = "ip"
            snmpPort = "162"
    }
    event = {
            eventServer = "127.0.0.1"
            logicalAddressMode = "ip"
            snmpPort = "163"
    }
    agent = {
            agentServer = "10.64.7.20"
            logicalAddressMode = "ip"
            snmpPort = "1161"
            historyOutput = "clog://localhost/../log/history.log;lines=12000;width=200;flags=rw+;mode=644;mmap=false"
    }
    platform = {
            platformServer = "10.64.7.20"
            logicalAddressMode = "ip"
            snmpPort = "166"
            historyOutput = "clog://localhost/../log/history.log;lines=12000;width=200;flags=rw+;mode=644;mmap=false"
    }
    security = {
            privOID = "1.3.6.1.6.3.10.1.2.2"
    }