Logging Traps

[zekebash]

Hello,

This should be a simple question. We configured our C9300, C9200, and ISR4331 devices with "Logging trap critical" and sending the logs to a syslog server. When we check the log entries, we find entries pertaining to BPDUs or access port status (UP/DOWN). Out goal is not log these low level conditions but the critical ones.

My question is why does the "CRITICAL" trap create these type of low level log entries? Which trap level would prevent sending these types of low level conditions (see below)?

Thanks in advance.

186>250322: Jun 22 14:54:49.604: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port Gi1/0/27 with BPDU Guard enabled. Disabling port.

[inderdeeps]

@zekebash : Check if you can change the sev of the logs 

Test-SW-121(config)#logging trap ?
<0-7> Logging severity level
alerts Immediate action needed (severity=1)
critical Critical conditions (severity=2)
debugging Debugging messages (severity=7)
emergencies System is unusable (severity=0)
errors Error conditions (severity=3)

[zekebash]

yes, I can. My question is which severity level would not send those low level alerts?

Thanks!

[balaji.bandi]

logging trap level

where level is one of the following, listed in descending order of priority:

• emergencies
• alerts
• critical
• errors
• warnings
• notifications
• informational (default level)
• debugging

 

[zekebash]

Thanks! 

Which one of those severity levels would not send "BPDU" or "access port activity" alerts?

Thanks, ~zK

[inderdeeps]

@zekebash : you can put that only warnings and can be ignored !

[balaji.bandi]

Since you directing to syslog, you go higher Log level (not full debug) to all the information about the switch, you can filter in syslog what logs you want. (look at Longer solution rather small for now)

[marce1000]

 - By default , -2- denotes a critical error , you may mask them with a logging discriminator , for instance.

           (https://www.youtube.com/watch?v=Lbb7vlQoGt0)

 M.