ISR4321 and ISR4221 do not send all messages to logging servers

[katerina.dardoufa]

Hello,

we have ISR4321 and ISR4221 deployed in our environment. Logging levels are set to debugging (console, monitoring, buffer, trap). Not all messages though are sent to the syslog servers. I managed to packet capture syslog messages that are sent to the syslog servers, in order to see if OSFP messages (which I am interested in) are sent across. These syslog messages never leave the routers.

When I type "show log | in OSPF"  %OSPF-5-ADJCHG messages do actually appear, but the packet capture never shows them leaving. Other informational (5) messages get across.

The IOS we are running is:

isr4200-universalk9_ias.16.04.02.SPA.bin on our 4221 and

isr4300-universalk9.03.16.04b.S.155-3.S4b-ext.SPA.bin or our 4321.

Any help will be highly appreciated!

Katerina

[mvsheik123]

Hi,

Please post output for 'show logging' and also syslog logging related commands from the router.

Thanks,

MS

[katerina.dardoufa]

Hello,

here is the output:

sh logging
Syslog logging: enabled (0 messages dropped, 4 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
No Active Message Discriminator.
No Inactive Message Discriminator.
    Console logging: level debugging, 2644 messages logged, xml disabled,
                    filtering disabled
    Monitor logging: level debugging, 24 messages logged, xml disabled,
                     filtering disabled
        Logging to: vty866(24)
    Buffer logging:  level debugging, 2647 messages logged, xml disabled,
                    filtering disabled
    Exception Logging: size (4096 bytes)
    Count and timestamp logging messages: disabled
    Persistent logging: disabled
No active filter modules.
    Trap logging: level informational, 2650 message lines logged
        Logging to x.x.x.x  (udp port 514, audit disabled,
              link up),
              2649 message lines logged,
              0 message lines rate-limited,
              0 message lines dropped-by-MD,
              xml disabled, sequence number disabled
              filtering disabled
        Logging to z.z.z.z  (udp port 514, audit disabled,
              link up),
              2650 message lines logged,
              0 message lines rate-limited,
              0 message lines dropped-by-MD,
              xml disabled, sequence number disabled
              filtering disabled
        Logging Source-Interface:       VRF Name:

show run | in logging

logging source-interface Loopback0
logging host 10.130.107.31
logging host 10.130.107.30

Thanks!

[mvsheik123 · Accepted solution]

Hi,

Thanks for the output. Plain and straight forward. When OSPF dropped, router able to reach syslog server? In case there is no route to reach syslog during OSPF neighbor failure, you may not be able to see those messages in the syslog.

hth

MS

[katerina.dardoufa]

I wiill try to see if the traps get to the snmp servers, during this time...

[katerina.dardoufa]

And also add a static route to the config. 

[katerina.dardoufa]

You were correct! When the adjacency was down the messages could not reach the syslog server. I would have expected that when the adjacency came back up, the new message would reach the server, but apparently it doesn't. I then added a static route pointing to my outgoing interface, with a high metric as to not interfere with the dynamic routing in normal operation, and the problem was solved.

Thanks!