This article is also available for viewing online at http://knowledgebase.solarwinds.

com/kb/questions/3596/
Troubleshooting "Unmatched Data" or "Internal New Tool Data" alerts in your LEM Console
Overview
Periodically, you might see "Unmatched Data" or "Internal New Tool Data" alerts in your LEM Console, which indicate
one or more of the connectors on your appliance cannot properly normalize the log data they are associated with.
This article contains troubleshooting procedures for syslog and Agent devices.
Troubleshooting Syslog Devices
Complete the following troubleshooting procedures for devices that send logs to a syslog facility on your LEM
appliance.
Verify the connector and device are pointed at the same local facility.
Check the configuration on your device to determine what local facility it's logging to on your LEM appliance.
In some cases, you cannot modify this setting. For additional information, search for your device in the
Connectors section of the LEM Knowledgebase.
1.
Verify that the connector is pointed to the same logging facility as the device:
Open your LEM Console and log into your LEM appliance as an administrator. a.
Click the Manage tab, and then select Appliances. b.
Click the gear icon next to your LEM appliance, and then select Tools. c.
Locate the connector in the list. Use the search box at the top of the Refine Results pane, or select
Configured if necessary.
d.
Select the configured connector to view its details. Verify the Log File value matches the output value
in your device's configuration.
Note: The output value, usually "logging facility," for Cisco devices is equal to the local facility on your
LEM appliance plus 16. Therefore, if your Cisco device is pointed to logging facility 23, it's logging to
/var/log/local7.log on your LEM appliance.
e.
2.
If the the device and connector configurations do not match, point the connector to the appropriate
location:
Stop the connector: gear icon > Stop a.
Open the connector for editing: gear icon > Edit b.
Change the Log File value so it matches your device. c.
Click Save. d.
Start the connector: gear icon > Start e.
3.
Verify that certain devices are not logging to the same local facility.
Certain devices, mainly Cisco, have similar enough logging formats that they cause connector conflicts when they're
logging to the same facility on your LEM appliance. Use the following procedure and table to determine what devices
are logging to each facility, and whether those devices conflict with one another.
Connect to your LEM appliance using a VMware "console" view, or an SSH client such as PuTTY. 1.
If you're connecting to your appliance through SSH, log in as the CMC user, and provide the appropriate
password.
2.
If you're connecting to your appliance using VMware, select Advanced Configuration on the main
console screen, and then press Enter to get to the command prompt.
3.
At the cmc> prompt, enter appliance. 4.
At the cmc::acm# prompt, enter checklogs. 5.
Enter an item number to select a local facility to view. 6.
Look for indications of specific devices logging to this facility, such as the product name, device name, or IP
address.
7.
If you see that two or more devices are logging to the same facility, consult the following table to
determine whether those devices conflict with one another.
8.
Table of Conflicting Devices
Ensure the devices in each of these groups are logging to distinct local facilities on your LEM appliance. For
example, if a device in Group 1 is logging to local1, make sure a device in Group 2 is not also logging to that
facility.
Print Article - Troubleshooting "Unmatched Data" or "Internal New Too... http://knowledgebase.solarwinds.com/kb/questions/3596/__print
1 of 3 9/2/2014 8:41 AM
Group Devices
Group 1 Cisco ASA
Cisco IOS
Cisco PIX
Group 2 Cisco Catalyst (CatOS)
Group 3 Cisco Wireless LAN Controller (WLC)
Group 4 Dell PowerConnect

Apply the latest connector update package.
If you completed the other procedures in this section and you still see the "Unmatched Data" or "Internal New Tool
Data" alerts, apply the latest connector package before calling Support. For instructions on how to apply the latest
connector update package, see How to apply a LEM connector update package.
Troubleshooting Agent Devices/Connectors
Complete the following troubleshooting procedures for LEM Agent connectors, such as Windows-based and database
connectors.
Verify the connector is pointing to the appropriate folder/event log.
Check the configuration on the host computer to determine what folder/event log it's logging to. In some
cases, you cannot modify this setting. For additional information, search for your device in the Connectors
section of the LEM Knowledgebase.
1.
Verify that the connector is pointed to the same folder/event log as the device:
Open your LEM Console and log into your LEM appliance as an administrator. a.
Click the Manage tab, and then select Nodes. b.
Click the gear icon next to the LEM Agent for the host computer, and then select Tools. c.
Locate the connector in the list. Use the search box at the top of the Refine Results pane, or select
Configured if necessary.
d.
Select the configured connector to view its details. Verify the Log File value matches the output value
in the host computer's configuration.
e.
2.
If the the host computer and connector configurations do not match, point the connector to the
appropriate location:
Stop the connector: gear icon > Stop a.
Open the connector for editing: gear icon > Edit b.
Change the Log File value so it matches the host computer. c.
Click Save. d.
Start the connector: gear icon > Start e.
3.
Apply the latest connector update package.
If you completed the other procedure in this section and you still see the "Unmatched Data" or "Internal New Tool
Data" alerts, apply the latest connector package before calling Support. For instructions on how to apply the latest
connector update package, see How to apply a LEM connector update package.
Contacting Support
If you are unable to resolve your issue using this article, open a ticket with SolarWinds Support for further assistance.
Please be prepared to provide the following once you are in touch with a representative:
A copy of the LEM Report, Tool Maintenance by Tool Alias, for the period during which you saw the
"Unmatched Data" or "Internal New Tool Data" alerts
For syslog devices: A sample of the logs currently being sent to LEM for the affected connector
1
For Windows connectors: A copy of the entire event log in .evtx format
For database connectors (required): A sample of the event table containing the events not being read,
along with details about those events
For database connectors (optional): If possible, the schema for the database
1
To generate a syslog sample from the LEM appliance:
Connect to your LEM appliance using a VMware "console" view, or an SSH client such as PuTTY. 1.
If you're connecting to your appliance through SSH, log in as the CMC user, and provide the appropriate 2.
Print Article - Troubleshooting "Unmatched Data" or "Internal New Too... http://knowledgebase.solarwinds.com/kb/questions/3596/__print
2 of 3 9/2/2014 8:41 AM
password.
If you're connecting to your appliance using VMware, select Advanced Configuration on the main
console screen, and then press Enter to get to the command prompt.
3.
At the cmc> prompt, enter appliance. 4.
At the cmc::acm# prompt, enter exportsyslog. 5.
Enter an item number to select a local facility to export. 6.
Repeat the previous step to specify more than one facility. 7.
Enter q to procede. 8.
Follow the on-screen instructions to complete the export. 9.
Print Article - Troubleshooting "Unmatched Data" or "Internal New Too... http://knowledgebase.solarwinds.com/kb/questions/3596/__print
3 of 3 9/2/2014 8:41 AM