Hi, I've got a problem with logging discriminators that is driving me nuts. I've read the articles here (http://www.cisco.com/c/en/us/td/docs/ios/12_4t/12_4t11/htnmsylg.html#wp1056441) and here (http://www.ciscopress.com/articles/article.asp?p=426638) but still can't seem to get this to work. I'm running this on a Catalyst 3750E stack (5 members) running 12.2(44r)SE3. There's some kind of bug in this version of IOS which swaps the temp and signal values read from the TenGE SFPs, resulting in tons of spurious threshold violation warnings (this is evident especially in the temperature threshold value of 0.0C!). That said, it's not worth the risk/reward ratio of upgrading IOS on all these devices - I'd rather just filter the messages out.
Messages I want to exclude from being logged (to the buffer, or to the syslog host)
Sep 16 19:16:44: %SFF8472-5-THRESHOLD_VIOLATION: Te5/0/1: Temperature high warning; Operating value: 26.4 C, Threshold value: 0.0 C. (sw-5)
Sep 16 19:16:44: %SFF8472-5-THRESHOLD_VIOLATION: Te5/0/1: Rx power high alarm; Operating value: -3.1 dBm, Threshold value: -40.0 dBm. (sw-5)
Sep 16 19:16:44: %SFF8472-5-THRESHOLD_VIOLATION: Te5/0/1: Tx power high alarm; Operating value: -2.5 dBm, Threshold value: -40.0 dBm. (sw-5)
Config I am using:
logging discriminator thr-viol severity includes 5 mnemonics drops THRESH
logging file flash:logfile.txt 51200 warnings
logging buffered discriminator thr-viol 100000
logging cns-events notifications
logging facility local6
logging source-interface Vlan2
logging host WW.XX.YY.ZZ discriminator thr-viol
For the logging discriminator command I have also tried:
logging discriminator thr-viol facility drops SFF8472 (risky, since it would also drop higher-sev messages I may want to see)
logging discriminator thr-viol mnemonics drops THRESHOLD (or THRESHOLD_VIOLATION, or THRESHOLD*)
None of the combinations I've tried, are working. Each time, the log messages keep appearing. The weird thing is, if I do a "show logging" it actually says some messages have been filtered by the discriminator at some point:
switch#sh log
Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
Active Message Discriminator:
thr-viol severity group includes 5
mnemonics drops THRESH
No Inactive Message Discriminator.
Console logging: level debugging, 1717691 messages logged, xml disabled,
filtering disabled
Monitor logging: level debugging, 2689 messages logged, xml disabled,
filtering disabled
Buffer logging: level debugging, 43 messages logged, xml disabled,
filtering disabled, discriminator(thr-viol),
0 messages rate-limited, 62 messages dropped-by-MD
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
File logging: file flash:logfile.txt,
max size 51200, min size 0,
level warnings, 112 messages logged
Persistent logging: disabled
No active filter modules.
Trap logging: level informational, 1903582 message lines logged
Logging to WW.XX.YY.ZZ (udp port 514, audit disabled,
authentication disabled, encryption disabled, link up),
17329 message lines logged,
0 message lines rate-limited,
62 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering enabled, discriminator (thr-viol)
Log Buffer (100000 bytes):
Sep 16 19:07:45: %SFF8472-5-THRESHOLD_VIOLATION: Te4/0/2: Temperature high warning; Operating value: 27.2 C, Threshold value: 0.0 C. (switch-4)
Sep 16 19:07:45: %SFF8472-5-THRESHOLD_VIOLATION: Te4/0/2: Rx power high alarm; Operating value: -2.8 dBm, Threshold value: -40.0 dBm. (switch-4)
Sep 16 19:07:45: %SFF8472-5-THRESHOLD_VIOLATION: Te4/0/2: Tx power high alarm; Operating value: -2.6 dBm, Threshold value: -40.0 dBm. (switch-4)
(rest of output snipped for brevity)
Any ideas?
