topic Worked for me for our IE2000s in Switching

What does 'link down" mean when viewing output of sh logging for a specific logging to server?

fatboyinva — Wed, 06 Mar 2019 17:16:25 GMT

On a 3560 I have (2) syslog servers defined. Both are up and operational and reachable via ping from the switch. However on the second defined logging server on the output of the sh logging command it states a "link down" (see below for command output). This syslog server is not receiving any syslog traps defined. The logging defined is logging trap warnings. I have verified trap messages are in the log output at the defined severity level and above(error/critical). My assumption is that the link down has something to do with why no syslog is being sent to this server.

   Logging to x.x.x.x (udp port 514, audit disabled,
              authentication disabled, encryption disabled, link up),
              225 message lines logged,
              0 message lines rate-limited,
              0 message lines dropped-by-MD,
              xml disabled, sequence number disabled
              filtering disabled
        Logging to x.x.x.x (udp port 514, audit disabled,
              authentication disabled, encryption disabled, link down),
              0 message lines logged,
              0 message lines rate-limited,
              0 message lines dropped-by-MD,
              xml disabled, sequence number disabled
              filtering disabled

thanks,

james

Re: What does 'link down" mean when viewing output of sh logging

Jon Marshall — Wed, 13 Jan 2010 15:39:50 GMT

fatboyinva wrote:

thanks,

james

James

You assumption is correct. For some reason the switch thinks that the second syslog server is not working hence the reason it doesn't send any messages.

I know you said you could ping it but can you confirm that the syslog service is actually up and running on the 2nd server and that there is filtering either

1) on the syslog server itself

2) along the path from the switch to the syslog server that is denying udp port 514

Jon

Re: What does 'link down" mean when viewing output of sh logging

fatboyinva — Wed, 13 Jan 2010 15:59:03 GMT

Jon,

To answer your questions:

1) Syslog is running on the server. The windows server is running Kiwi/Solarwinds. When I do a netstat -an I see udp 514 listening:

UDP 0.0.0.0:514 *:*

I am also receiving other syslog data from Cisco switches on this syslog server. In addition windows firewall is turned off.

2) The only device between this Cisco 3560 and the syslog server is another Cisco switch (distribution switch). No firewall or other blocking device exists in addition to any access lists. Here's a sample traceroute;

Type escape sequence to abort.
Tracing the route to (x.x.x.x)

1 x.x.x x msec 0 msec 0 msec
2 (x.x.x.x) 9 msec 0 msec 0 msec

thanks for your reply.

Re: What does 'link down" mean when viewing output of sh logging

LemmorOtazzir — Wed, 23 Jun 2010 11:50:23 GMT

Hi Folks

Good Afternoon

I am facing the same issue as describe above with a few 4948's switches. I was wondering if any solution was found?

many thanks

Re: What does 'link down" mean when viewing output of sh logging

jawill47ec — Wed, 23 Jun 2010 20:18:51 GMT

Hello,

I did not find a fix, but the resolution in our case was to reload the switch. That seemed to clear the ip sockets table. Also, a helpful command that was used is sh ip sockets. Here is a sample output:

Proto    Remote      Port      Local      Port     In Out Stat TTY OutputIF
17     --listen--                  1.2.1.41    1975   0   0     11     0
17     0.0.0.0             0     1.2.1.41      67     0   0    2211   0
17     0.0.0.0             0     1.2.1.41    2228    0   0    211    0
17     10.1.1.1        60059 1.2.1.41     161    0   0    1       0
17   --listen--                     1.2.1.41     162    0   0   11      0
17   --listen--                     1.2.1.41   60380   0   0    1       0
17   --listen--          --any--                  161    0   0   20001 0
17   --listen--          --any--                  162    0   0   20011 0
17   --listen--          --any--                 64379 0   0   20001 0
17   --listen--                   1.2.1.41     123   0 0 1   0
17   172.17.9.2      514    1.2.1.41      58781   0   0 400201 0
17   172.17.8.2      514    1.2.1.41      55647   0   0 400201 0

thanks,

james

Re: What does 'link down" mean when viewing output of sh lo

LemmorOtazzir — Wed, 23 Jun 2010 21:08:41 GMT

thanks James I will try it.

Thanks again for that I do appreciate.

Rommel

On Wed, Jun 23, 2010 at 9:18 PM, jawill47ec <

Probably poor form to wake

yaleman13 — Wed, 09 Apr 2014 02:48:11 GMT

Probably poor form to wake this up from many years ago, but we found today that turning off syslog and turning it back on (after confirming routes are OK) also reset this functionality - tested on a 3750. (It could have been the trap level as well, we changed this at the same time).

Commands:

# no logging trap warnings

# logging trap informational

Not at all, this solution

nathanielscriven — Fri, 07 Nov 2014 15:24:09 GMT

Not at all, this solution worked for us. Thank you for posting!

Thank you! This worked for

_NATALIE_ — Wed, 08 Jul 2015 20:50:52 GMT

Thank you! This worked for us on a 6509E.

This is still a current

Chris Cheesman — Tue, 20 Sep 2016 12:38:38 GMT

This is still a current solution! Used it this morning on a pair of ASR1006 routers. Many thanks.

Worked for me for our IE2000s

Wed, 02 Aug 2017 14:51:38 GMT

Worked for me for our IE2000s. Changing the logging level is what did it. Changed it to informational the link came up. Changed it back to warning and the link stayed up.

Re: Worked for me for our IE2000s

novajoseph2000 — Sun, 29 Jul 2018 11:14:45 GMT

I am using IBM Qrador , I was not able to send logs after command i am getting logs

no logging trap warnings
logging trap informational

thanks again for the solution

Re: Probably poor form to wake

Amafsha1 — Fri, 31 Aug 2018 20:10:12 GMT

Thank you sir, this worked!

Re: Probably poor form to wake

jthorne — Thu, 21 Feb 2019 00:07:00 GMT

Hey, worked liked a charm, thanks, better late then never.

Re: Probably poor form to wake

Okidusk — Thu, 02 Apr 2020 11:12:49 GMT

This worked for me, thanks!

Re: Probably poor form to wake

AdityaThammineni1502 — Tue, 26 May 2020 10:52:02 GMT

This worked like a charm (y)

Re: What does 'link down" mean when viewing output of sh logging

rossbarbour — Fri, 20 Aug 2021 07:55:39 GMT

Just experienced this after changing versions on a 4948 switch.

After further testing it would appear that the "link down" message is an indicator that 0 messages have been sent and nothing to do with whether or not packet are getting to or being received at the "logging host w.x.y.z" device (it's UDP! so its send and forget)

To force a message to get through
#send log 5 "Test syslog message"

would attempt to send a message at SYSLOG level 5 (NOTICE).

On a old s/w version this worked fine when

"logging trap warnings"
was configured
but after upgrading to a newer version of code

"logging trap warnings"

seemed to stop the

send log 5 "Test syslog message"

getting sent which makes sense if you've configured it to ONLY send "syslog WARNINGS" (which is level 4) and NOT "syslog NOTICE" (which is level 5).
and should also appear in the output of "show logging" assuming normal config.

I'm sure these should send messages at the same level or LOWER

e.g.
0 Emergency e
1 Alert alert
2 Critical
3 Error
4 Warning
5 Notice
6 Informational
7 Debug

So sending at a lower number
send log 1 "Test syslog message"
is more likely to get sent compared to

send log 7 "Test syslog message"
and depends on how you've configured your device.

logging trap xxxxxx

Bottom line is that "link down" is a bit of a red herring and really just means I've not send a message to the configured "logging host"
Once a message has been sent it goes "link up" and if you reboot it will stay at "link down" until a syslog message gets sent to the logging host.

Whether the device sends a syslog message is based on configuration AND also when events/traps actually happen (or are forced into the log with the "send log" command as shown above)

Hope this helps.

Re: Probably poor form to wake

RBrower — Fri, 28 Apr 2023 14:40:42 GMT

Maybe this was poor form, but I sure appreciate it because I had been trying to fix this on our core and a reboot was out of the question. Still relevant nearly 10 years later.

Re: Worked for me for our IE2000s

KhanAkhtar — Sat, 27 May 2023 08:17:59 GMT

i am using IBM Qrador, Can you send full configuration ?

Thanks

Re: Probably poor form to wake

ship-west — Mon, 28 Aug 2023 11:50:14 GMT

Disabling the logging did not work for me. Changing to a different logging level and back did work.