cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
936
Views
0
Helpful
1
Replies

Nexus 5548UP wrong logging order in log file

huangdeqing
Level 1
Level 1

We have a Nexus 5548UP switch, it logs required events, however when show logging, the logged events is not displayed in proper order. Starting April 23, 2019, the logged events were inserted into the logfile from the top. Does anyone encounter same issue? I searched Cisco bug no luck.

 

5K# sh logging last 5
2019 Apr 23 04:57:06 HCSLIDCN5K02 %ETHPORT-5-IF_UP: Interface Ethernet1/26 is up in mode trunk
2019 Apr 23 04:57:06 HCSLIDCN5K02 %ETHPORT-5-IF_UP: Interface port-channel94 is up in mode trunk
2019 Apr 23 15:56:23 HCSLIDCN5K02 %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user x215328 from 100.70.240.80 - ss
hd[16589]
2019 Apr 23 15:56:23 HCSLIDCN5K02 %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user x215328 from 100.70.240.80 - ss
hd[16590]
2019 Apr 23 15:56:23 HCSLIDCN5K02 %DAEMON-3-SYSTEM_MSG: error: PAM: Authentication failure for illegal user x215328 from 100.70.
240.80 - sshd[16589]

 

The logs after April 23, 2019 were inserted into the log file from the top:

5K# sh logg logfile
2015 Apr 26 08:12:23 HCSLIDCN5K02 %USER-2-SYSTEM_MSG: CLIS: loading cmd files begin - clis
2019 Apr 23 16:23:24 HCSLIDCN5K02 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by x215328 on 100.70.240.80@pts/1
2015 Apr 26 08:12:35 HCSLIDCN5K02 Apr 26 08:12:25 %KERN-0-SYSTEM_MSG: [ 8.133008] I2C - Mezz absent - kernel
2019 Apr 23 16:32:00 HCSLIDCN5K02 %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user x215328 from 100.70.240.80 - ss
hd[17249]
2015 Apr 26 08:12:35 HCSLIDCN5K02 Apr 26 08:12:25 %KERN-3-SYSTEM_MSG: [ 10.429915] sd 0:0:0:0: [sda] Assuming drive cache: wri
te through - kernel
2019 Apr 23 16:32:00 HCSLIDCN5K02 %DAEMON-3-SYSTEM_MSG: error: PAM: Authentication failure for x215328 from 100.70.240.80 - sshd
[17218]
2015 Apr 26 08:12:35 HCSLIDCN5K02 Apr 26 08:12:25 %KERN-3-SYSTEM_MSG: [ 10.431300] sd 0:0:0:0: [sda] Assuming drive cache: wri
te through - kernel
2019 Apr 23 22:30:28 HCSLIDCN5K02 %ETHPORT-3-IF_ERROR_VLANS_SUSPENDED: VLANs 1169 on Interface port-channel22 are being suspende
d. (Reason: Vlan is not allowed on Peer-link)

 

1 Reply 1

huangdeqing
Level 1
Level 1

This is bug CSCui73960 which states "Log messages in local logfile buffer are not sorted properly based on their timestamp. The "sort" pipe option sorts them better but still not in the fully sorted way."

Review Cisco Networking for a $25 gift card