Re: ISR 4461 17.0.04a Not Showing Logging In Console - Page 2

TW80CJ5 · ‎04-14-2022

Team,

I have a 4461 running 17.03.04a and it's returning odd snmp information when I show logging. I have configured logging console and term monitor.

However, when I issue the show log command, I get a mudslide of the following with no traditional logging statements in the console.

I have removed everything snmp from server, user, etc. but it still shows. I have cleared the log cache as well.

Here is the first 250 lines of whats returned on show log which is approximately 2700 lines:

#sh log
Syslog logging: enabled (0 messages dropped, 13255 messages rate-limited, 0 flushes, 1 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

Console logging: level informational, 2312985 messages logged, xml disabled,
filtering disabled
Monitor logging: level informational, 15020 messages logged, xml disabled,
filtering disabled
Logging to: vty866(71)
Buffer logging: level debugging, 9543498 messages logged, xml disabled,
filtering disabled
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled

No active filter modules.

Trap logging: level informational, 134816 message lines logged
Logging to 192.168.2.45 (NTMGMT) (tcp port 514, audit disabled,
link down),
0 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
Logging Source-Interface: VRF Name:
Loopback255 NTMGMT

Log Buffer (100000 bytes):
e.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
ckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

SrV2GenerateNotification:Function has reached clean up routine.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
CheckMIBView: OID is in MIB view.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
SrCheckNotificationFilter: OID is included.
Sr_send_trap: trap sent to 192.168.2.45:162

Richard Burts · ‎04-18-2022

So the recent post with output of show logging was from a different device? That would explain why console logging was disabled. Can you get the output from the right device?

HTH

Rick

TW80CJ5 · ‎04-18-2022

Rick,

The information provided is from the correct router. Sorry for the confusion.

Richard Burts · ‎04-18-2022

Still a bit unsure about what is going on. From the output you provided this is the most important (and most clear) thing

no logging console

So there is no logging on the console port. (note when connected to the console the show logging command should still give you messages that have been logged for past events) With this setting you would not get log messages on the console as events happen.

From the output posted I would expect that if you are remotely logged in that terminal monitor should work and would display log messages as events happen (but would not show log messages about events in the past).

And I would expect that the command show log should show messages about events that happened in the past (could be executed from a console connection or from a remote connection).

Is that what you are experiencing on the router?

HTH

Rick

TW80CJ5 · ‎04-18-2022

Rick,

Yessir. You are correct. I am remotely logged in via ssh. The past events you describe are not showing when I enter sh log. The only events that show are the following (posted earlier but since I have done a poor job of explaining, I will post again )

Apr 18 2022 14:19:53.682: %SYS-5-LOG_CONFIG_CHANGE: Buffer logging: level informational, xml disabled, filtering disabled, size (1000000)
Apr 18 2022 14:19:53.682: %PARSER-5-CFGLOG_LOGGEDCMD: User:xxxxxxxxxxxxxx logged command:logging buffered 1000000 informational
Apr 18 2022 14:19:54.872: %SYS-5-CONFIG_I: Configured from console by xxxxxxxxxxxxxx on vty0 (192.168.2.67)
Apr 18 2022 14:22:29.689: %SYS-5-LOG_CONFIG_CHANGE: Console logging disabled
Apr 18 2022 14:22:29.689: %PARSER-5-CFGLOG_LOGGEDCMD: User:xxxxxxxxxxxxxx logged command:no logging console informational
Apr 18 2022 14:22:35.647: %SYS-5-CONFIG_I: Configured from console by xxxxxxxxxxxxxx on vty0 (192.168.2.67)
Apr 18 2022 14:31:40.694: %SYS-6-TTY_EXPIRE_TIMER: (exec timer expired, tty 866 (192.168.2.67)), user xxxxxxxxxxxxxx
Apr 18 2022 14:31:40.694: %SYS-6-LOGOUT: User xxxxxxxxxxxxxx has exited tty session 866(192.168.2.67)
Apr 18 2022 14:53:12.509: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: xxxxxxxxxxxxxx] [Source: 192.168.2.67] [localport: 22] at 14:53:12 zulu Mon Apr 18 2022
Apr 18 2022 14:53:12.616: %PARSER-5-CFGLOG_LOGGEDCMD: User:unknown user logged command:!exec: enable
Apr 18 2022 15:13:29.368: %SYS-6-TTY_EXPIRE_TIMER: (exec timer expired, tty 866 (192.168.2.67)), user xxxxxxxxxxxxxx
Apr 18 2022 15:13:29.368: %SYS-6-LOGOUT: User xxxxxxxxxxxxxx has exited tty session 866(192.168.2.67)
Apr 18 2022 15:32:51.450: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: xxxxxxxxxxxxxx] [Source: 192.168.2.67] [localport: 22] at 15:32:51 zulu Mon Apr 18 2022
Apr 18 2022 15:32:51.559: %PARSER-5-CFGLOG_LOGGEDCMD: User:unknown user logged command:!exec: enable

No other logs are diplaying either past or current when I issue the sh log command via ssh.

Richard Burts · ‎04-18-2022

Thanks for trying again. This time I paid closer attention to what was in the log messages that you posted and that does provide some insight. So what I am noticing is:

- Apr 18 2022 14:19:53.682: %SYS-5-LOG_CONFIG_CHANGE: Buffer logging: level informational, xml disabled, filtering disabled, size (1000000)

Here you disabled logging buffered

- Apr 18 2022 14:19:53.682: %PARSER-5-CFGLOG_LOGGEDCMD: User:xxxxxxxxxxxxxx logged command:logging buffered 1000000 informational

And here you enabled logging buffered. The result of this is that all content of older log messages was eliminated and the buffer starts over again and it is empty.

- Apr 18 2022 14:22:29.689: %SYS-5-LOG_CONFIG_CHANGE: Console logging disabled

Here you disabled logging to the console so no more current log messages will be sent to the console. show log for historical messages should work - but there will be none earlier than 14:19:53.682.

There are some messages in the log display. Are there events that you know of that should be in the log but are not? If so what are they?

HTH

Rick

TW80CJ5 · ‎04-18-2022

Rick,

I really appreciate you staying with me through this. I know there are ACL's being hit on the router. I can watch the the numbers of matches change on them.

To prevent an impact to production, I am going to come in early and reboot the router. It was working fine last week, then poof....no more logs.

I will keep you posted. Thanks again for all of the help.

Richard Burts · ‎04-19-2022

You are welcome.

The acls that are being hit, do they use the log parameter on the deny statements (have they generated log messages in the past)? It can not hurt to reboot, but I am not optimistic that reboot is going to change much about this issue.

HTH

Rick

TW80CJ5 · ‎04-19-2022

Good morning Rick,

Yessir, I am logging all of my deny statements.

Looks like my reboot has been rescheduled until Friday...

Richard Burts · ‎04-19-2022

Thanks for the update. Let us know the results when you reboot.

HTH

Rick

Georg Pauwen · ‎04-15-2022

Hello,

these look more like debug outputs. What if you disable all debugging (u all) ?

ISR4461#u all

TW80CJ5 · ‎04-15-2022

Morning Georg....

I verified that all debugging was off. It was one of the things I tried. I re-issued "u all" but the output is still the same.

Thank you for your time!

Georg Pauwen · ‎04-15-2022

Hello,

post the full running configuration (sh run) of your 4461...

TW80CJ5 · ‎05-12-2022

Team / Gents....

Sorry to provide such a delayed update, but due to various restrictions, I was finally able to schedule the ASI. A simple reboot corrected the logging. I hate those types of answers too, but its all I have.

Thanks for all of the assistance. Its greatly appreciated.

balaji.bandi · ‎05-12-2022

Sometimes i feel Cisco follows MS - reboot fixes many issues nowadays... appreciate your input.

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Richard Burts · ‎05-12-2022

Thanks for the update. Glad to know that now it is working as expected. Sometimes a reboot does fix things. (both for MS and for Cisco)

In reading through the discussion I noticed something that I missed the (how many times have I read through this discussion) other times I have looked through it. You had enabled logging for MANY snmp traps

logging snmp-trap emergencies
logging snmp-trap alerts
logging snmp-trap critical
logging snmp-trap errors
logging snmp-trap warnings
logging snmp-trap notifications

I think the output in most of your posts was due to the snmp trap logging. Is it possible that this was crowding out the other log messages? Is it possible that the snmp trap logging is no longer configured?

HTH

Rick