04-16-2012 04:02 AM - edited 03-03-2019 06:32 AM
Hello,
I'm trying to enable some debugs, like debug voip application all, but I want the output to be logged to an external server in XML format.
I issued the following commands:
logging on
logging host x.x.x.x xml
logging trap debugging
The logs are sent to the external server, but they're not in XML format but in the regular format.
This is what show logging shows:
cmuc03(config)# do sh log
Syslog logging: enabled (266448 messages dropped, 32 messages rate-limited, 0 flushes, 245 overruns, xml enabled, filter
ing disabled)
No Active Message Discriminator.
No Inactive Message Discriminator.
Console logging: disabled
Monitor logging: level debugging, 54967 messages logged, xml disabled,
filtering disabled
Buffer logging: disabled, xml disabled,
filtering disabled
Exception Logging: size (8192 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled
No active filter modules.
Trap logging: level debugging, 1569723 message lines logged
Logging to 192.168.1.2 (udp port 514, audit disabled,
link up),
305 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml enabled, sequence number disabled
filtering disabled
Logging Source-Interface: VRF Name:
Did I miss something?
Regards,
Grant
Solved! Go to Solution.
05-02-2012 11:14 AM
I did a little testing and found that the problem is only seen for debug messages, not normal IOS messages. The issue is that debugs and error messages are implemented differently in IOS, so when xml logging was implemented, it was only implemented for error messages (informational and higher severity). So, I don't think xml logging of debugs has ever worked, and I don't think there are any plans to implement it because we (in TAC) try to encourage customers not to log debugs to syslogs. Some debugs are very noisy and the burden of printing them to a syslog server can cause a service disruption on the router or switch.
If you know this has worked on other IOS devices or IOS versions, let me know, because I couldn't find evidence that it does.
04-27-2012 10:42 AM
Hi Grant,
Can you give us a show version? How exactly do you know that the server isn't receiving xml? Maybe a sniffer cpature that shows it?
05-01-2012 11:28 PM
Hello Preston,
I've ran a wireshark trace, but the syslog messages are all just plain text. There is no XML to spot.
Cisco IOS Software, C3900e Software (C3900e-UNIVERSALK9-M), Version 15.2(3)T, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Fri 23-Mar-12 21:00 by prod_rel_team
ROM: System Bootstrap, Version 15.1(1r)T2, RELEASE SOFTWARE (fc1)
cmuc03 uptime is 1 week, 19 hours, 40 minutes
System returned to ROM by reload at 12:37:35 CET Tue Apr 24 2012
System image file is "flash:c3900e-universalk9-mz.SPA.152-3.T.bin"
Last reload type: Normal Reload
Last reload reason: Reload Command
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
Cisco CISCO3945-CHASSIS (revision 1.0) with C3900-SPE250/K9 with 1793024K/304128K bytes of memory.
Processor board ID FCZ150423W1
4 Gigabit Ethernet interfaces
1 Virtual Private Network (VPN) Module
DRAM configuration is 72 bits wide with parity enabled.
256K bytes of non-volatile configuration memory.
254464K bytes of ATA System CompactFlash 0 (Read/Write)
License Info:
License UDI:
-------------------------------------------------
Device# PID SN
-------------------------------------------------
*0 C3900-SPE250/K9 FOC15013FAW
Technology Package License Information for Module:'c3900e'
-----------------------------------------------------------------
Technology Technology-package Technology-package
Current Type Next reboot
------------------------------------------------------------------
ipbase ipbasek9 Permanent ipbasek9
security securityk9 Permanent securityk9
uc uck9 Permanent uck9
data datak9 Permanent datak9
Configuration register is 0x2102
05-02-2012 11:14 AM
I did a little testing and found that the problem is only seen for debug messages, not normal IOS messages. The issue is that debugs and error messages are implemented differently in IOS, so when xml logging was implemented, it was only implemented for error messages (informational and higher severity). So, I don't think xml logging of debugs has ever worked, and I don't think there are any plans to implement it because we (in TAC) try to encourage customers not to log debugs to syslogs. Some debugs are very noisy and the burden of printing them to a syslog server can cause a service disruption on the router or switch.
If you know this has worked on other IOS devices or IOS versions, let me know, because I couldn't find evidence that it does.
05-04-2012 12:01 AM
Alright, it's clear now.
When I configure logging host 192.168.1.1 the debugs are sent to the syslog server, but there is a difference in what is sent to the syslog server and what appears in the logging buffer. The logging buffer contains more debug messages.
Do you know a reason why this is?
05-04-2012 08:35 AM
Hi Grant,
This is another reason we don't recommend troubleshooting by sending debugs to syslog. The number of debugs can overwhelm the system so that we drop messages from the syslog queue and they never get sent to the server. By design, it's more important that they make it into the loggigng buffer so that should be where you go for troubleshooting. Overall, the best practice for debugging is this, especially for noisy debugs:
- Ensure that you aren't logging debugs to console, monitor, or syslog (the top of show log will tell you the level of each. This will save you from maxing out cpu, and let you type on the sesion with debugs spewing out.
- increase the size of the logging buffer
- use "show log" or "show log | i
Remember that "u all" will turn off all debugs, so if you ever get in a state where the debugs are out of control, type this and hit enter even if you can't see what you've typed through all the debugs, evnetually they should disable.
05-06-2012 11:13 PM
Alright, I know everything I need.
Thank you for your help.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide