How to filter only "debug eigrp" without rest of incoming syslogs?

[jmaxwellUSAF]

Hello

How can I allow only the results of "debug eigrp" without seeing the rest of the incoming syslogs?

Thank you!

[David Ruess]

Depends on what you're trying to debug:

You can debug by packet type (hellos, replies, queries, updates, etc.)

*debug eigrp packets [ SIAquery | SIAreply | ack | hello | ipxsap | probe | query | reply | request | retry | stub | terse | update | verbose ] [ detail ] - you can mix and match packet types on a single line. the "packets" keyword does all of them

*debug eigrp address-family [ ipv4 | ipv6 ] neighbor [ip-address]

There are more in the document if you just do a find for "eigrp"

https://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/118974-technote-eigrp-00.html

-David

[jmaxwellUSAF]

just entering "debug eigrp" produces nothing.

"logging monitor" in conjunction with "terminal monitor" shows syslog messages as well as the debug , such as...

"*Aug 17 15:15:59.328 DEST: %SEC-6-IPACCESSLOGP: list SecurityACL denied tcp 11.2.3.4(5290) -> 7.7.7.7(2200), 1 packet".

How do i see ONLY the EIGRP debugging output from interface tu77?

[David Ruess]

None of the examples I provide or that were in the document say debug eigrp only so you are correct it will not do anything. You need to provide the full correct syntax of what you're are tying to debug. Furthermore if your looking for something specific you can narrow down the EIGRP packets you need to see in the debug. I'm not sure if there is a specific interface you can debug EIGRP for but you should be able to debug per neighbor. You can choose the neighbor the tunnel is using.

You might be able to disable the other logs form showing up by entering the no logging on command.

[pieterh · Accepted solution]

in adition to above
>>> How can I allow only the results of "debug eigrp" without seeing the rest of the incoming syslogs? <<<

I assume you are talking about logging displayed to a telnet/ssh session (hence the "terminal monitor"command) is this correct ?
just for terminology:  the keyword "syslog" is usually associated to messages sent to a syslog server, 
the output on your terminal session is called system logging (and it is output, not incoming)
if you DO mean incoming syslogs on a syslog server, you need use the commands needed on the syslog server to filter the output

the command "debug eigrp" is not meant to display ONLY eigrp debugging messages, but it enables debugging for eigrp, 
in addition to all other messages that are still displayed to your session with "terminal moinitor" enabled
as @David Ruess explained you need to filter the output, but if you use "terminal monitor" there is no easy way to filter

logging is organized with a priority called "severity level" see System Message Logging - Cisco  Table 3 Message Logging Level
when enabling logging level debugging, then ALL lower levels are also displayed
so there is not an  easy way to display only debugging (eigrp) messages

instead of enabling terminal monitor, you can configure a logging buffer
you can configure an appropriate size for your goal
then you can use "show logging bugger | include EIGRP|string2|string3" to filter lines with specific content to be displayed
this is not online output, but may be the best you can get, without all "normal" logging output

logging buffered [size] [level]

Logs messages to an internal buffer. The default buffer size is 4096. The range is 4096 to 2147483647 bytes. Levels include emergencies 0, alerts 1, critical 2, errors 3, warnings 4, notifications 5, informational 6, and debugging 7.

Note Do not make the buffer size too large because the access point could run out of memory for other tasks. Use the show memory command in privileged EXEC mode to view the free processor memory on the device; however, this processor memory value is the maximum available, and you should not set the buffer size to this amount.