Buy or Renew
Buy or Renew
Cisco + Splunk: It’s a new day for your data. Learn more.
 
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
2499
Views
0
Helpful
31
Replies

ISR 4461 17.0.04a Not Showing Logging In Console

TW80CJ5
Level 3
Level 3

‎04-14-2022 01:54 PM

Team,

I have a 4461 running 17.03.04a and it's returning odd snmp information when I show logging. I have configured logging console and term monitor. 

 

However, when I issue the show log command, I get a mudslide of the following with no traditional logging statements in the console.

I have removed everything snmp from server, user, etc. but it still shows. I have cleared the log cache as well.

 

Here is the first 250 lines of whats returned on show log which is approximately 2700 lines:

#sh log
Syslog logging: enabled (0 messages dropped, 13255 messages rate-limited, 0 flushes, 1 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

 

No Inactive Message Discriminator.


Console logging: level informational, 2312985 messages logged, xml disabled,
filtering disabled
Monitor logging: level informational, 15020 messages logged, xml disabled,
filtering disabled
Logging to: vty866(71)
Buffer logging: level debugging, 9543498 messages logged, xml disabled,
filtering disabled
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled

No active filter modules.

Trap logging: level informational, 134816 message lines logged
Logging to 192.168.2.45 (NTMGMT) (tcp port 514, audit disabled,
link down),
0 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging Source-Interface: VRF Name:
Loopback255 NTMGMT

Log Buffer (100000 bytes):
e.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
ckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

 

 

Labels:
0 Helpful
31 Replies 31

balaji.bandi
Hall of Fame
Hall of Fame

‎04-14-2022 04:39 PM 

Console logging: level informational, 2312985 messages logged, xml disabled,
filtering disabled

what i hear is you do not see any logs on the console ?

you configured as information logging on console. that is ok, check are you able to see any information doing shut no shut interface any free ports see you getting any logs ?

 

also can you post show run | in logging

 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

0 Helpful

TW80CJ5
Level 3
Level 3
In response to balaji.bandi

‎04-15-2022 05:01 AM

Morning BB...

 

Yes, I am able to see logging information in the console when I shut / no shut ports or other various console logs, like entering config t.

 

Here is the sh run | inc logging:

 

#sh run | inc logging
logging userinfo
logging buffered 100000
logging console informational
logging monitor informational
no device-tracking logging theft
logging enable
logging alarm informational
logging source-interface Loopback999 vrf NET_MGMT
logging server-arp
logging snmp-trap emergencies
logging snmp-trap alerts
logging snmp-trap critical
logging snmp-trap errors
logging snmp-trap warnings
logging snmp-trap notifications
logging host 192.168.2.52 vrf CECS_MGMT transport tcp port 514
logging synchronous
logging synchronous
logging synchronous
ntp logging

 

 

 

0 Helpful

balaji.bandi
Hall of Fame
Hall of Fame
In response to TW80CJ5

‎04-15-2022 12:53 PM

Apologies, i may be missing some information. the issue is you see logs, or do not see logs in the console?

 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

0 Helpful

Richard Burts
Hall of Fame
Hall of Fame
In response to balaji.bandi

‎04-16-2022 08:52 PM

I agree that there is some ambiguity, the title of the post suggests that the problem is about console logging. But the output shown in the original post is clearly from show log. So the issue seems not to be about console logging but about logging buffered.

Would the original poster give us the output of show debug?

HTH

Rick
0 Helpful

TW80CJ5
Level 3
Level 3
In response to Richard Burts

‎04-17-2022 09:21 AM

BB and Richard...

 

Agreed. Sorry for the confusion. Let me try to clarify.

 

When I issue the show log command, I only see the output included in the original post. There are no denied or permitted ACL entries as there usually is.

 

I am able to see logging in the console when something happens, i.e., shut / no shut the interface, however, when I try to use the show log command, it is not listing anything there except for what was included in the original post.

 

As soon as I get into the office Monday morning, I will include a show debug.

0 Helpful

Georg Pauwen
VIP
VIP
In response to TW80CJ5

‎04-17-2022 11:23 PM

Hello,

 

try and increase the 'logging buffered 100000' value to something higher...

0 Helpful

TW80CJ5
Level 3
Level 3
In response to Georg Pauwen

‎04-18-2022 07:15 AM

Georg,

 

I removed logging buffered 100000 and reissued logging buffered 1000000 command.

 

Still not showing logs in the sh log

 

0 Helpful

TW80CJ5
Level 3
Level 3
In response to Richard Burts

‎04-18-2022 07:12 AM

Here is the show debug:

 

sh debug
IOSXE Conditional Debug Configs:

Conditional Debug Global State: Stop


IOSXE Packet Tracing Configs:

 

 

Packet Infra debugs:

Ip Address Port
------------------------------------------------------|----------

 

0 Helpful

TW80CJ5
Level 3
Level 3
In response to Richard Burts

‎04-18-2022 07:21 AM

Also, to start the troubleshooting process, I issued the clear log command. It removed all of the log types that were included in the original post. Just an FYI.

0 Helpful

Richard Burts
Hall of Fame
Hall of Fame
In response to TW80CJ5

‎04-18-2022 07:50 AM

Thanks for the additional information. The output of show debug does confirm that currently no debug is running. I do have some comments:

- thanks for confirming that logging to the console is working and that the issue is about the messages that show up in the original post.

- there are not any date or time stamp information in what you posted. Was there any data or time information in the logs that you were seeing? 

- especially if you are not seeing any of these messages in current logging I wonder if it might have been the result of some activity in the past (that is not happening now)?

- as I look more carefully at the messages in the original post I recognize that they are all related to the generation of snmp traps. And I see this in the output of a previous post

logging snmp-trap emergencies
logging snmp-trap alerts
logging snmp-trap critical
logging snmp-trap errors
logging snmp-trap warnings
logging snmp-trap notifications

So my guess at this point is that at some time in the past there were events that generated snmp traps. And generating the snmp traps generated these log messages. If you do not want to see these log messages then I suggest that you remove the config statements about snmp-trap.

HTH

Rick
0 Helpful

TW80CJ5
Level 3
Level 3
In response to Richard Burts

‎04-18-2022 08:04 AM

Richard,

 

Thanks for the response...let me see if I can do a better job of explaining the problem.

 

On the router config, I have multiple ACL's. Previously, when I would enter the show log command, I would see the permitted or denied ACL hits. When I enter sh log now, there are no ACL hit entries.

 

I know the ACL's are getting hit as I can see their match counters grow when I enter the sh ip access-lists command.

 

Ideas?

0 Helpful

Richard Burts
Hall of Fame
Hall of Fame
In response to TW80CJ5

‎04-18-2022 08:15 AM

It sounds to me like we are dealing with 2 different issues. In the original post the issue was log messages that you did not understand (and probably did not want to see in the logs). Now the issue is that you are not seeing log messages that you believe should be there.

Since it appears that things have changed (some messages that were appearing are no long appearing and some messages that were appearing are not appearing) can we get fresh data about logging? I would suggest posting the first couple pages of output from show log. And perhaps also helpful to get the output of show run | include logging

HTH

Rick
0 Helpful

TW80CJ5
Level 3
Level 3
In response to Richard Burts

‎04-18-2022 08:38 AM

Rick,

 

Thank you for your patience. Here is the information requested:

 

#sh logging
Syslog logging: enabled (0 messages dropped, 13255 messages rate-limited, 0 flushes, 1 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

 

No Inactive Message Discriminator.


Console logging: disabled
Monitor logging: level informational, 15068 messages logged, xml disabled,
filtering disabled
Buffer logging: level informational, 14 messages logged, xml disabled,
filtering disabled
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled

No active filter modules.

Trap logging: level informational, 134935 message lines logged
Logging to 192.168.2.52 (NET_MGMT) (udp port 514, audit disabled,
link down),
0 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging Source-Interface: VRF Name:
Loopback99 NET_MGMT

Log Buffer (1000000 bytes):

Apr 18 2022 14:19:53.682: %SYS-5-LOG_CONFIG_CHANGE: Buffer logging: level informational, xml disabled, filtering disabled, size (1000000)
Apr 18 2022 14:19:53.682: %PARSER-5-CFGLOG_LOGGEDCMD: User:xxxxxxxxxxxxxx logged command:logging buffered 1000000 informational
Apr 18 2022 14:19:54.872: %SYS-5-CONFIG_I: Configured from console by xxxxxxxxxxxxxx on vty0 (192.168.2.67)
Apr 18 2022 14:22:29.689: %SYS-5-LOG_CONFIG_CHANGE: Console logging disabled
Apr 18 2022 14:22:29.689: %PARSER-5-CFGLOG_LOGGEDCMD: User:xxxxxxxxxxxxxx logged command:no logging console informational
Apr 18 2022 14:22:35.647: %SYS-5-CONFIG_I: Configured from console by xxxxxxxxxxxxxx on vty0 (192.168.2.67)
Apr 18 2022 14:31:40.694: %SYS-6-TTY_EXPIRE_TIMER: (exec timer expired, tty 866 (192.168.2.67)), user xxxxxxxxxxxxxx
Apr 18 2022 14:31:40.694: %SYS-6-LOGOUT: User xxxxxxxxxxxxxx has exited tty session 866(192.168.2.67)
Apr 18 2022 14:53:12.509: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: xxxxxxxxxxxxxx] [Source: 192.168.2.67] [localport: 22] at 14:53:12 zulu Mon Apr 18 2022
Apr 18 2022 14:53:12.616: %PARSER-5-CFGLOG_LOGGEDCMD: User:unknown user logged command:!exec: enable
Apr 18 2022 15:13:29.368: %SYS-6-TTY_EXPIRE_TIMER: (exec timer expired, tty 866 (192.168.2.67)), user xxxxxxxxxxxxxx
Apr 18 2022 15:13:29.368: %SYS-6-LOGOUT: User xxxxxxxxxxxxxx has exited tty session 866(192.168.2.67)
Apr 18 2022 15:32:51.450: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: xxxxxxxxxxxxxx] [Source: 192.168.2.67] [localport: 22] at 15:32:51 zulu Mon Apr 18 2022
Apr 18 2022 15:32:51.559: %PARSER-5-CFGLOG_LOGGEDCMD: User:unknown user logged command:!exec: enable

 

#sh run | inc logging
logging userinfo
logging buffered 1000000 informational
no logging console
logging monitor informational
no device-tracking logging theft
logging enable
logging alarm informational
logging source-interface Loopback99 vrf NET_MGMT
logging server-arp
logging snmp-trap emergencies
logging snmp-trap alerts
logging snmp-trap critical
logging snmp-trap errors
logging snmp-trap warnings
logging snmp-trap notifications
logging host 192.168.2.52 vrf NET_MGMT transport udp port 514
logging synchronous
logging synchronous
logging synchronous
ntp logging

0 Helpful

TW80CJ5
Level 3
Level 3
In response to Richard Burts

‎04-18-2022 08:48 AM - edited ‎04-18-2022 08:49 AM

Rick,


Sorry for the confusion. Router is still not logging correctly> iwas looking at the wrong device.

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents