Re: ISR 4461 17.0.04a Not Showing Logging In Console

TW80CJ5 · ‎04-14-2022

Team,

I have a 4461 running 17.03.04a and it's returning odd snmp information when I show logging. I have configured logging console and term monitor.

However, when I issue the show log command, I get a mudslide of the following with no traditional logging statements in the console.

I have removed everything snmp from server, user, etc. but it still shows. I have cleared the log cache as well.

Here is the first 250 lines of whats returned on show log which is approximately 2700 lines:

#sh log
Syslog logging: enabled (0 messages dropped, 13255 messages rate-limited, 0 flushes, 1 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

Console logging: level informational, 2312985 messages logged, xml disabled,
filtering disabled
Monitor logging: level informational, 15020 messages logged, xml disabled,
filtering disabled
Logging to: vty866(71)
Buffer logging: level debugging, 9543498 messages logged, xml disabled,
filtering disabled
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled

No active filter modules.

Trap logging: level informational, 134816 message lines logged
Logging to 192.168.2.45 (NTMGMT) (tcp port 514, audit disabled,
link down),
0 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging Source-Interface: VRF Name:
Loopback255 NTMGMT

Log Buffer (100000 bytes):
e.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
ckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

balaji.bandi · ‎04-14-2022

Console logging: level informational, 2312985 messages logged, xml disabled,
filtering disabled

what i hear is you do not see any logs on the console ?

you configured as information logging on console. that is ok, check are you able to see any information doing shut no shut interface any free ports see you getting any logs ?

also can you post show run | in logging

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

TW80CJ5 · ‎04-15-2022

Morning BB...

Yes, I am able to see logging information in the console when I shut / no shut ports or other various console logs, like entering config t.

Here is the sh run | inc logging:

#sh run | inc logging
logging userinfo
logging buffered 100000
logging console informational
logging monitor informational
no device-tracking logging theft
logging enable
logging alarm informational
logging source-interface Loopback999 vrf NET_MGMT
logging server-arp
logging snmp-trap emergencies
logging snmp-trap alerts
logging snmp-trap critical
logging snmp-trap errors
logging snmp-trap warnings
logging snmp-trap notifications
logging host 192.168.2.52 vrf CECS_MGMT transport tcp port 514
logging synchronous
logging synchronous
logging synchronous
ntp logging

balaji.bandi · ‎04-15-2022

Apologies, i may be missing some information. the issue is you see logs, or do not see logs in the console?

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Richard Burts · ‎04-16-2022

I agree that there is some ambiguity, the title of the post suggests that the problem is about console logging. But the output shown in the original post is clearly from show log. So the issue seems not to be about console logging but about logging buffered.

Would the original poster give us the output of show debug?

HTH

Rick

TW80CJ5 · ‎04-17-2022

BB and Richard...

Agreed. Sorry for the confusion. Let me try to clarify.

When I issue the show log command, I only see the output included in the original post. There are no denied or permitted ACL entries as there usually is.

I am able to see logging in the console when something happens, i.e., shut / no shut the interface, however, when I try to use the show log command, it is not listing anything there except for what was included in the original post.

As soon as I get into the office Monday morning, I will include a show debug.

Georg Pauwen · ‎04-17-2022

Hello,

try and increase the 'logging buffered 100000' value to something higher...

TW80CJ5 · ‎04-18-2022

Georg,

I removed logging buffered 100000 and reissued logging buffered 1000000 command.

Still not showing logs in the sh log

TW80CJ5 · ‎04-18-2022

Here is the show debug:

sh debug
IOSXE Conditional Debug Configs:

Conditional Debug Global State: Stop

IOSXE Packet Tracing Configs:

Packet Infra debugs:

Ip Address Port
------------------------------------------------------|----------

TW80CJ5 · ‎04-18-2022

Also, to start the troubleshooting process, I issued the clear log command. It removed all of the log types that were included in the original post. Just an FYI.

Richard Burts · ‎04-18-2022

Thanks for the additional information. The output of show debug does confirm that currently no debug is running. I do have some comments:

- thanks for confirming that logging to the console is working and that the issue is about the messages that show up in the original post.

- there are not any date or time stamp information in what you posted. Was there any data or time information in the logs that you were seeing?

- especially if you are not seeing any of these messages in current logging I wonder if it might have been the result of some activity in the past (that is not happening now)?

- as I look more carefully at the messages in the original post I recognize that they are all related to the generation of snmp traps. And I see this in the output of a previous post

logging snmp-trap emergencies
logging snmp-trap alerts
logging snmp-trap critical
logging snmp-trap errors
logging snmp-trap warnings
logging snmp-trap notifications

So my guess at this point is that at some time in the past there were events that generated snmp traps. And generating the snmp traps generated these log messages. If you do not want to see these log messages then I suggest that you remove the config statements about snmp-trap.

HTH

Rick

TW80CJ5 · ‎04-18-2022

Richard,

Thanks for the response...let me see if I can do a better job of explaining the problem.

On the router config, I have multiple ACL's. Previously, when I would enter the show log command, I would see the permitted or denied ACL hits. When I enter sh log now, there are no ACL hit entries.

I know the ACL's are getting hit as I can see their match counters grow when I enter the sh ip access-lists command.

Ideas?

Richard Burts · ‎04-18-2022

It sounds to me like we are dealing with 2 different issues. In the original post the issue was log messages that you did not understand (and probably did not want to see in the logs). Now the issue is that you are not seeing log messages that you believe should be there.

Since it appears that things have changed (some messages that were appearing are no long appearing and some messages that were appearing are not appearing) can we get fresh data about logging? I would suggest posting the first couple pages of output from show log. And perhaps also helpful to get the output of show run | include logging

HTH

Rick

TW80CJ5 · ‎04-18-2022

Rick,

Thank you for your patience. Here is the information requested:

#sh logging
Syslog logging: enabled (0 messages dropped, 13255 messages rate-limited, 0 flushes, 1 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

Console logging: disabled
Monitor logging: level informational, 15068 messages logged, xml disabled,
filtering disabled
Buffer logging: level informational, 14 messages logged, xml disabled,
filtering disabled
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled

No active filter modules.

Trap logging: level informational, 134935 message lines logged
Logging to 192.168.2.52 (NET_MGMT) (udp port 514, audit disabled,
link down),
0 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging Source-Interface: VRF Name:
Loopback99 NET_MGMT

Log Buffer (1000000 bytes):

Apr 18 2022 14:19:53.682: %SYS-5-LOG_CONFIG_CHANGE: Buffer logging: level informational, xml disabled, filtering disabled, size (1000000)
Apr 18 2022 14:19:53.682: %PARSER-5-CFGLOG_LOGGEDCMD: User:xxxxxxxxxxxxxx logged command:logging buffered 1000000 informational
Apr 18 2022 14:19:54.872: %SYS-5-CONFIG_I: Configured from console by xxxxxxxxxxxxxx on vty0 (192.168.2.67)
Apr 18 2022 14:22:29.689: %SYS-5-LOG_CONFIG_CHANGE: Console logging disabled
Apr 18 2022 14:22:29.689: %PARSER-5-CFGLOG_LOGGEDCMD: User:xxxxxxxxxxxxxx logged command:no logging console informational
Apr 18 2022 14:22:35.647: %SYS-5-CONFIG_I: Configured from console by xxxxxxxxxxxxxx on vty0 (192.168.2.67)
Apr 18 2022 14:31:40.694: %SYS-6-TTY_EXPIRE_TIMER: (exec timer expired, tty 866 (192.168.2.67)), user xxxxxxxxxxxxxx
Apr 18 2022 14:31:40.694: %SYS-6-LOGOUT: User xxxxxxxxxxxxxx has exited tty session 866(192.168.2.67)
Apr 18 2022 14:53:12.509: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: xxxxxxxxxxxxxx] [Source: 192.168.2.67] [localport: 22] at 14:53:12 zulu Mon Apr 18 2022
Apr 18 2022 14:53:12.616: %PARSER-5-CFGLOG_LOGGEDCMD: User:unknown user logged command:!exec: enable
Apr 18 2022 15:13:29.368: %SYS-6-TTY_EXPIRE_TIMER: (exec timer expired, tty 866 (192.168.2.67)), user xxxxxxxxxxxxxx
Apr 18 2022 15:13:29.368: %SYS-6-LOGOUT: User xxxxxxxxxxxxxx has exited tty session 866(192.168.2.67)
Apr 18 2022 15:32:51.450: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: xxxxxxxxxxxxxx] [Source: 192.168.2.67] [localport: 22] at 15:32:51 zulu Mon Apr 18 2022
Apr 18 2022 15:32:51.559: %PARSER-5-CFGLOG_LOGGEDCMD: User:unknown user logged command:!exec: enable

#sh run | inc logging
logging userinfo
logging buffered 1000000 informational
no logging console
logging monitor informational
no device-tracking logging theft
logging enable
logging alarm informational
logging source-interface Loopback99 vrf NET_MGMT
logging server-arp
logging snmp-trap emergencies
logging snmp-trap alerts
logging snmp-trap critical
logging snmp-trap errors
logging snmp-trap warnings
logging snmp-trap notifications
logging host 192.168.2.52 vrf NET_MGMT transport udp port 514
logging synchronous
logging synchronous
logging synchronous
ntp logging

TW80CJ5 · ‎04-18-2022

Rick,

Sorry for the confusion. Router is still not logging correctly> iwas looking at the wrong device.