11-05-2019 06:22 AM
We have a Nexus 5548UP switch, it logs required events, however when show logging, the logged events is not displayed in proper order. Starting April 23, 2019, the logged events were inserted into the logfile from the top. Does anyone encounter same issue? I searched Cisco bug no luck.
5K# sh logging last 5
2019 Apr 23 04:57:06 HCSLIDCN5K02 %ETHPORT-5-IF_UP: Interface Ethernet1/26 is up in mode trunk
2019 Apr 23 04:57:06 HCSLIDCN5K02 %ETHPORT-5-IF_UP: Interface port-channel94 is up in mode trunk
2019 Apr 23 15:56:23 HCSLIDCN5K02 %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user x215328 from 100.70.240.80 - ss
hd[16589]
2019 Apr 23 15:56:23 HCSLIDCN5K02 %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user x215328 from 100.70.240.80 - ss
hd[16590]
2019 Apr 23 15:56:23 HCSLIDCN5K02 %DAEMON-3-SYSTEM_MSG: error: PAM: Authentication failure for illegal user x215328 from 100.70.
240.80 - sshd[16589]
The logs after April 23, 2019 were inserted into the log file from the top:
5K# sh logg logfile
2015 Apr 26 08:12:23 HCSLIDCN5K02 %USER-2-SYSTEM_MSG: CLIS: loading cmd files begin - clis
2019 Apr 23 16:23:24 HCSLIDCN5K02 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by x215328 on 100.70.240.80@pts/1
2015 Apr 26 08:12:35 HCSLIDCN5K02 Apr 26 08:12:25 %KERN-0-SYSTEM_MSG: [ 8.133008] I2C - Mezz absent - kernel
2019 Apr 23 16:32:00 HCSLIDCN5K02 %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user x215328 from 100.70.240.80 - ss
hd[17249]
2015 Apr 26 08:12:35 HCSLIDCN5K02 Apr 26 08:12:25 %KERN-3-SYSTEM_MSG: [ 10.429915] sd 0:0:0:0: [sda] Assuming drive cache: wri
te through - kernel
2019 Apr 23 16:32:00 HCSLIDCN5K02 %DAEMON-3-SYSTEM_MSG: error: PAM: Authentication failure for x215328 from 100.70.240.80 - sshd
[17218]
2015 Apr 26 08:12:35 HCSLIDCN5K02 Apr 26 08:12:25 %KERN-3-SYSTEM_MSG: [ 10.431300] sd 0:0:0:0: [sda] Assuming drive cache: wri
te through - kernel
2019 Apr 23 22:30:28 HCSLIDCN5K02 %ETHPORT-3-IF_ERROR_VLANS_SUSPENDED: VLANs 1169 on Interface port-channel22 are being suspende
d. (Reason: Vlan is not allowed on Peer-link)
02-13-2020 07:04 AM
This is bug CSCui73960 which states "Log messages in local logfile buffer are not sorted properly based on their timestamp. The "sort" pipe option sorts them better but still not in the fully sorted way."
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide