Switch Log

anand · ‎06-18-2005

Hi,

yesterday one of my Cisco 2950-24T has restarted automatically, because of this all the PC's connected on this switch got hang as their application is fully dependent on the server located on different switch,there were no power fluctuations, but no idea how it has restarted automatically, could any one let me know is there any possibility for checking the swich log for the switch restart?. i tried "show logging" i see switch restarted & other messages like "Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)

Console logging: level debugging, 98 messages logged

Monitor logging: level debugging, 0 messages logged

Buffer logging: level debugging, 98 messages logged

File logging: disabled

Trap logging: level informational, 102 message lines logged

Logging to 10.194.1.100, 102 message lines logged

Log Buffer (4096 bytes):

PDOWN: Interface FastEthernet0/4, changed state to down

12:33:47: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/4, changed state to down"

amit-singh · ‎06-18-2005

Hi Anand,

Once your switch reboots it clears all the logs and you wont be see any logs. However you can use " Show version " output to see how the switch rebooted.

This is show version from one of my switch :

Cisco Internetwork Operating System Software

IOS (tm) C3500XL Software (C3500XL-C3H2S-M), Version 12.0(5.3)WC(1), MAINTENANCE

INTERIM SOFTWARE

Compiled Mon 30-Apr-01 07:51 by devgoyal

Image text-base: 0x00003000, data-base: 0x003331F4

ROM: Bootstrap program is C3500XL boot loader

C48-BS6 uptime is 3 weeks, 13 hours, 29 minutes

System returned to ROM by power-on ----> Check this line.

System image file is "flash:c3500XL-c3h2s-mz.120-5.3.WC.1.bin"

cisco WS-C3524-PWR-XL (PowerPC403) processor (revision 0x01) with 8192K/1024K by

tes of memory.

Processor board ID CAT0552Y0FR, with hardware revision 0x00

Last reset from power-on----->

Processor is running Enterprise Edition Software

Cluster command switch capable

Cluster member switch capable

24 FastEthernet/IEEE 802.3 interface(s)

2 Gigabit Ethernet/IEEE 802.3 interface(s)

32K bytes of flash-simulated non-volatile configuration memory.

Base ethernet MAC Address: 00:08:A3:31:0A:C0

Motherboard assembly number: 73-4033-07

Power supply part number: 34-0968-02

Motherboard serial number: CAT055201Q8

Power supply serial number: LIT05480336

Model revision number: F0

Motherboard revision number: D0

Model number: WS-C3524-PWR-XL-EN

Daughterboard serial number: CAT055200WB

System serial number: CAT0552Y0FR

Configuration register is 0xF

the line above will tell you the reason why the switch rebooted.

HTH,

-amit singh

anand · ‎06-18-2005

Hi Amith,

below is the sh ver of th switch which got restaretd yesterday, the one which i have underlined, you mean to say that this could be reason, "Last reset from system-reset" does it mean, my switch got restarted by the itself?

sh ver

Cisco Internetwork Operating System Software

IOS (tm) C2950 Software (C2950-C3H2S-M), Version 12.0(5.3)WC(1), MAINTENANCE INTERIM SOFTWARE

Compiled Mon 30-Apr-01 07:56 by devgoyal

Image text-base: 0x80010000, data-base: 0x8031A000

ROM: Bootstrap program is CALHOUN boot loader

MPdesk uptime is 20 hours, 5 minutes

System returned to ROM by power-on

System restarted at 13:28:06 UTC Fri Jun 17 2005

System image file is "flash:c2950-c3h2s-mz.120-5.3.WC.1.bin"

cisco WS-C2950T-24 (RC32300) processor (revision B0) with 22260K bytes of memory.

Processor board ID FOC0549Z12G

-----------------------------

Last reset from system-reset

-----------------------------

Processor is running Enterprise Edition Software

Cluster command switch capable

Cluster member switch capable

24 FastEthernet/IEEE 802.3 interface(s)

2 Gigabit Ethernet/IEEE 802.3 interface(s)

32K bytes of flash-simulated non-volatile configuration memory.

Base ethernet MAC Address: 00:08:21:9F:0A:C0

Motherboard assembly number: 73-6114-05

Power supply part number: 34-0965-01

Motherboard serial number: FOC054901TF

Power supply serial number: DAB05492T7T

Model revision number: B0

Motherboard revision number: B0

Model number: WS-C2950T-24

System serial number: FOC0549Z12G

Configuration register is 0xF

amit-singh · ‎06-18-2005

Yes,

You are right. The switch got restarted itself.

But we have make it out now that why the switch got restarted. I think may be due to high traffic the CPU utilization went high and it restarted itself.

HTH,

-amit singh

anand · ‎06-18-2005

Hi Amith,

i do agree in what you say, but when i checked some others swithces on the network which was restarted by me, i see the same message. below is for your referrence.

------------------------------------------------------

sh ver

Cisco Internetwork Operating System Software

IOS (tm) C2950 Software (C2950-C3H2S-M), Version 12.0(5.3)WC(1), MAINTENANCE INTERIM SOFTWARE

Compiled Mon 30-Apr-01 07:56 by devgoyal

Image text-base: 0x80010000, data-base: 0x8031A000

ROM: Bootstrap program is CALHOUN boot loader

RJ_Desk uptime is 21 weeks, 3 days, 15 hours, 25 minutes

System returned to ROM by power-on

System restarted at 19:41:58 UTC Tue Jan 18 2005

System image file is "flash:c2950-c3h2s-mz.120-5.3.WC.1.bin"

cisco WS-C2950T-24 (RC32300) processor (revision B0) with 22260K bytes of memory.

Processor board ID FOC0549Y11R

-----------------------------

Last reset from system-reset

-----------------------------

Processor is running Enterprise Edition Software

Cluster command switch capable

Cluster member switch capable

24 FastEthernet/IEEE 802.3 interface(s)

2 Gigabit Ethernet/IEEE 802.3 interface(s)

32K bytes of flash-simulated non-volatile configuration memory.

Base ethernet MAC Address: 00:08:21:9F:12:C0

Motherboard assembly number: 73-6114-05

Power supply part number: 34-0965-01

Motherboard serial number: FOC0549021F

Power supply serial number: DAB05492SGP

Model revision number: B0

Motherboard revision number: B0

Model number: WS-C2950T-24

System serial number: FOC0549Y11R

Configuration register is 0xF

------------------------------------------------------

amit-singh · ‎06-18-2005

Hi Anand,

That's strange. If you have restarted the switches or you have manually reloaded it should give you a message " System returned to ROM by reload "

Please check also the line that I listed in my first post.

RJ_Desk uptime is 21 weeks, 3 days, 15 hours, 25 minutes

---------------------------------------

System returned to ROM by power-on

--------------------------------------

System restarted at 19:41:58 UTC Tue Jan 18 2005

System image file is "flash:c2950-c3h2s-mz.120-5.3.WC.1.bin"

Please check the following link for system messages for system restart. Its the same for router and switches.

http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_tech_note09186a008010876d.shtml

Its very hard to determine why the switch got rebooted but by looking at the system restarted line in our case as it is listed as " System returned to ROM by power-on " .which means that it has simply been powered on.

regards,

-amit singh

Prashanth Krishnappa · ‎06-18-2005

Do a "dir flash:" and see if there are any crash files.

Do you use Cisco works to back up configs? There was a bug which could cause the switch to crash.

http://www.cisco.com/cgi-bin/bugtool/onebug.pl?bugid=CSCdv35805

Also, you are running a very old IOS. I suggest that you consider upgrading IOS to a newer 12.1 code

glen.grant · ‎06-19-2005

You may have to sift thru the "show tech " file, sometimes that will give you some insight .

Richard Burts · ‎06-19-2005

Looking for crashinfo files and looking through the output of show tech are both good suggestions. But in this case I am not sure they will get real far. From one of the messages posted by Anand:

MPdesk uptime is 20 hours, 5 minutes

System returned to ROM by power-on

System restarted at 13:28:06 UTC Fri Jun 17 2005

It believes that it was restarted by power-on and I am not confident that either crashinfo or show tech will have much.

I recently had a somewhat similar experience with a 2950 which ran fine when first started but after running for a while began to spontaneously reboot. And it indicated that restart was via power-on. I believe that it reflected heat buildup when running and may have been due to a flakey power supply. We requested RMA of the switch and I am not sure what the eventual findings were.

HTH

Rick

HTH

Rick