meaning of the symbols before log message in cisco devices

[bensonlei]

Hi, Guys,

simple question:

As the log messages below, what means for the symbols before messages ( especial for the symbol "." ):

*Mar  1 08:03:54.849 HKT: %STACKMGR-5-MASTER_READY: Master Switch 1 is READY (SISF0605-2)
*Mar  1 08:03:54.886 HKT: %STACKMGR-5-SWITCH_READY: Switch 2 is READY (SISF0605-2)
*Mar  1 08:03:55.080 HKT: %PLATFORM-6-FLEXSTACK_INSERTED: FlexStack module inserted in Switch 2. (SISF0605-2)
*Mar  1 08:03:58.268 HKT: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/49, changed state to up
*Mar  1 08:03:59.778 HKT: %DTP-5-TRUNKPORTON: Port Gi1/0/49 has become dot1q trunk
*Mar  1 08:03:58.772 HKT: %USB_CONSOLE-6-MEDIA_RJ45: Console media-type is RJ45. (SISF0605-2)
*Mar  1 08:04:00.292 HKT: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/49, changed state to up
*Mar  1 08:04:01.492 HKT: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan370, changed state to up
May 17 15:51:50.281 HKT: %LINK-3-UPDOWN: Interface GigabitEthernet2/0/49, changed state to up
May 17 15:51:52.305 HKT: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2/0/49, changed state to up
May 17 15:51:51.791 HKT: %DTP-5-TRUNKPORTON: Port Gi2/0/49 has become dot1q trunk (SISF0605-2)
May 17 15:51:53.081 HKT: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan370, changed state to down
May 17 15:51:53.175 HKT: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan370, changed state to up
.Jun 10 12:28:11.928 HKT: %SW_MATM-4-MACFLAP_NOTIF: Host 0021.5a63.4281 in vlan 835 is flapping between port Gi1/0/49 and port Gi2/0/49
.Jun 10 18:13:16.756 HKT: %SW_MATM-4-MACFLAP_NOTIF: Host 0021.856a.de56 in vlan 835 is flapping between port Gi2/0/49 and port Gi1/0/49
.Jul 13 00:03:13.040 HKT: %SW_MATM-4-MACFLAP_NOTIF: Host 000b.cdb9.94c9 in vlan 332 is flapping between port Gi2/0/49 and port Gi1/0/49
.Jul 13 00:03:21.066 HKT: %SW_MATM-4-MACFLAP_NOTIF: Host 000b.cdb9.94c9 in vlan 332 is flapping between port Gi1/0/49 and port Gi2/0/49
.Jul 13 03:22:24.617 HKT: %SW_MATM-4-MACFLAP_NOTIF: Host 0021.853c.1b11 in vlan 338 is flapping between port Gi2/0/49 and port Gi1/0/49
 

What situation the ".' will appear ?

"*" -- I think these messages while switch boot or reboot.

Thanks a lot

[rvarelac]

Hi bensonlei

If you asking for those symbols : 

.Jul 13 03:22:24.617 HKT: %SW_MATM-4-MACFLAP_NOTIF: Host 0021.853c.1b11 in vlan 338 is flapping between port Gi2/0/49 and port Gi1/0/49

They are the codes of the error. 

The log has multiple sections , see following : 

.Jul 13 03:22:24.617 HKT: DATE AND TIME 

 %SW_MATM-4-MACFLAP_NOTIF:  ERROR CODE 

Host 0021.853c.1b11 in vlan 338 is flapping between port Gi2/0/49 and port Gi1/0/49 : DESCRIPTION 

The number on the error code indicates the severity of the log : 

Description

0 - emergency  = System unusable

1 - alert = Immediate action needed

2 - critical =Critical condition

3 - error = Error condition

4 - warning = Warning condition

5 - notification =Normal but significant condition

6 - informational = Informational message only

7 - debugging = Appears during debugging only

Hope this help 

--Randy--

[Marvin Rhoads · Accepted solution]

When there is an asterisk ("*") or a period (".") preceding a log message it means that the device's time is not externally synchronized to an NTP server.

This is confirmed in this Cisco reference. (See the timestamp explanation just below Table 2.)

We usually expect the asterisks during initialization stages (before NTP synchronization can be expected have been established) and the periods when NTP sync has been lost.

[bensonlei]

Hi, Marvin,

Thanks for the precious answer.

May I know a bit more about  the answer. As my captured, the device clock was synch. And then the log message was being generated while in unsync clock:

1. NTP issue

2. Device CPU busy

3. Network traffic issue

4. Software issue 

Which one probably caused this unsync problem ? As the log message indicated network was flapping.

[Marvin Rhoads]

Reachability of the NTP server is the most likely issue.

Your network was not flapping in the log messages you shared - the MACFLAP messages posted above are most commonly caused by a wireless user moving back and forth from one AP to another.

The Mar 1 messages are most likely from a system startup as that is the default date (before ntp has a chance to synchronize the clock) on many Cisco devices.