cisco logging

nelba.aldovino · ‎07-05-2013

Hi All,

I'm having trouble with the logging in cisco. It started when I enable the debug ip packet command. I notice that after enabling it whenenver check the system log in csco 3750 it always show below image:

what I want to see is the below image when I execute the show logging command. How will I turn it back to this logging. I already turn off debug ip packet. Please help I'm already lost. I don't know what to do...

Thank you in advance and any help will be greatly appreciated,

Nhel

cadet alain · ‎07-05-2013

Hi,

type the command clear log in privileged mode.

Regards

Alain

Don't forget to rate helpful posts.

nelba.aldovino · ‎07-05-2013

Hi cadet alain,

I already did that but unfortately when I execute again the show logging it doesn't show the same log. It only showed below:

It does not show the link state messages.

cadet alain · ‎07-05-2013

Hi,

ok so if I understand correctly you want to see previous messages that were in the buffer before you got the debug output?

If you cleared the log then they are lost unless you also sent them to a syslog server.

If you log to the buffer don't forget that the buffer has a small size by default and that it is circular which means that once it is filled newest messages replace the older ones so as you fiiled it with the debug chatty output then it overwrote the log messages you wanted to see.

To summarize, you won't see them again unless you sent them to syslog server too and even without clearing the logs you would have been in same situation.

Regards

Alain

Don't forget to rate helpful posts.

nelba.aldovino · ‎07-05-2013

Nope, I'm not looking for logs before I clear it. What I want to see is the current messages in the cisco device. Even I down a port in that switch it does not show in the logging. It shows only the vty logs.

cadet alain · ‎07-05-2013

Hi,

ok can you post sh log and sh run | i logging

Regards

Alain

Don't forget to rate helpful posts.

nelba.aldovino · ‎07-07-2013

Hi!

Sorry for the late reply.

Please see attach as requested.

HOGP_B_CS01#show logging

Syslog logging: enabled (7179420 messages dropped, 0 messages rate-limited, 0 fl

ushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

Console logging: level debugging, 2284539 messages logged, xml disabled,

filtering disabled

Monitor logging: level debugging, 21075 messages logged, xml disabled,

filtering disabled

Buffer logging: level debugging, 2284539 messages logged, xml disabled,

filtering disabled

Exception Logging: size (4096 bytes)

Count and timestamp logging messages: disabled

File logging: disabled

Persistent logging: disabled

Trap logging: level informational, 848319 message lines logged

Log Buffer (4096 bytes):

*Sep 4 06:06:27.847 GMT: %SYS-5-CONFIG_I: Configured from console by fujitsu on

vty0 (172.25.75.68)

*Sep 4 06:13:04.762 GMT: %SYS-5-CONFIG_I: Configured from console by fujitsu on

vty0 (172.25.75.68)

*Sep 4 06:13:33.082 GMT: %SYS-5-CONFIG_I: Configured from console by fujitsu on

vty0 (172.25.75.68)

*Sep 4 06:13:58.659 GMT: %SYS-5-CONFIG_I: Configured from console by fujitsu on

vty0 (172.25.75.68)

*Sep 4 06:55:07.452 GMT: %SYS-5-CONFIG_I: Configured from console by fujitsu on

vty0 (172.25.75.68)

*Sep 4 06:55:08.517 GMT: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host Port 514 started - CLI initiated

*Sep 6 21:52:34.438 GMT: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host port 514 stopped - CLI initiated

*Sep 6 21:52:55.762 GMT: %SYS-5-CONFIG_I: Configured from console by fujitsu on

vty0 (IP Address)

*Sep 6 21:53:57.427 GMT: %SYS-5-CONFIG_I: Configured from console by fujitsu on

vty0 (IP Adress)

HOGP_B_CS01#sho run | i logging

logging synchronous

blau grana · ‎07-12-2013

Hello,

Did you try to configure any types of logging?

(config)#logging buffered ?

<0-7> Logging severity level

<4096-2147483647> Logging buffer size

alerts Immediate action needed (severity=1)

critical Critical conditions (severity=2)

debugging Debugging messages (severity=7)

emergencies System is unusable (severity=0)

errors Error conditions (severity=3)

filtered Enable filtered logging

informational Informational messages (severity=6)

notifications Normal but significant conditions (severity=5)

warnings Warning conditions (severity=4)

xml Enable logging in XML to XML logging buffer

Best Regards

Please rate all helpful posts and close solved questions

Best Regards Please rate all helpful posts and close solved questions

Richard Burts · ‎07-20-2013

From the information in his previous post it is clear that Nhel has not configured any special logging and that it is operating with default parameters.

Console logging: level debugging, 2284539 messages logged, xml disabled,

filtering disabled

Monitor logging: level debugging, 21075 messages logged, xml disabled,

filtering disabled

Buffer logging: level debugging, 2284539 messages logged, xml disabled,

filtering disabled

So console, monitor, and buffer logging are each operating at debug level. If interface down messages are generated they should be visible in the logs.

So now I am thinking about when interface down messages are generated and when they are not generated. In the original post there are some log messages indicating that the line protocol for some VLANs have changed state to down. (obviously messages were generated). But Nhel also says that "Even I down a port in that switch it does not show in the logging." (messages not generated). This leads me to think that the switch is configured so that a physical port changing state does not generate log messages but if the VLAN goes down that it does generate log messages. To prove this I wonder if Nhel would try the command

logging event link-status default

and let us know if the behavior changes.

You can use this link to get more information about it

http://www.cisco.com/en/US/docs/ios/fundamentals/command/reference/cf_l1.html#wp1025176

HTH

Rick

HTH

Rick

nelba.aldovino · ‎07-25-2013

Hi Richard,

Unfortunatel there's no logging event link-status default command in my core switch. Please see below for the available commands.

Thanks

Richard Burts · ‎07-26-2013

Nhel

Your post says see below for available commands. But there was nothing below.

You have told us that this is a 3750 switch but not which version of code it is running. So I looked in the command reference of a fairly recent version for 3750. The link is below. It says that there is an interface level command for logging event link-status. I do not find a global command in the command reference, though I know that there is a global command for at least some models of switch. Perhaps not for the 3750?

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_55_se/commmand/reference/cli1.html#wp11902103

HTH

Rick

HTH

Rick