Re: BGP flapped but was not logged

Chad Parish · ‎10-11-2018

So this morning I saw something odd. Apparently my BGP neighborship between my CE router and ISP PE router flapped several times between last evening and this morning. I see in the log where it flapped after 7pm last night and when it flapped around 6am this morning. However when I did a show ip bgp sum I see the following...

Neighbor V AS MsgRcvd Msg Sent TblVer InQ OutQ Up/Down State/PfxRcd
172.20.56.5 4 1803 1037 976 22186 0 0 07:22:33 224

But this would indicate the last flap was around 2am which does not appear in the log. Also, while the flap at 6:21am does show in the log, I would assume the BGP Summary would have reflected that.

Any ideas why the 2am flap didn't show in the logs and the 6:21am flapp isn't reflected in the BGP summary?

000268: Oct 10 07:24:31.555: %BGP-3-NOTIFICATION: received from neighbor 172.20.56.5 6/6 (Other Configuration Change) 0 bytes
000269: Oct 10 07:24:31.555: %BGP-5-NBR_RESET: Neighbor 172.20.56.5 reset (BGP Notification received)
000270: Oct 10 07:24:31.556: %BGP-5-ADJCHANGE: neighbor 172.20.56.5 Down BGP Notification received
000271: Oct 10 07:24:31.556: %BGP_SESSION-5-ADJCHANGE: neighbor 172.20.56.5 IPv4 Unicast topology base removed from session BGP Notification received
000272: Oct 10 07:24:34.562: %BGP-5-ADJCHANGE: neighbor 172.20.56.5 Up
000273: Oct 11 06:21:10.279: %LINK-3-UPDOWN: Interface GigabitEthernet0/0/0, changed state to down
000274: Oct 11 06:21:10.279: %PIM-5-NBRCHG: neighbor 172.20.56.5 DOWN on interface GigabitEthernet0/0/0 non DR
000275: Oct 11 06:21:10.284: %BGP-5-NBR_RESET: Neighbor 172.20.56.5 reset (Interface flap)
000276: Oct 11 06:21:10.320: %BGP-5-ADJCHANGE: neighbor 172.20.56.5 Down Interface flap
000277: Oct 11 06:21:10.320: %BGP_SESSION-5-ADJCHANGE: neighbor 172.20.56.5 IPv4 Unicast topology base removed from session Interface flap
000278: Oct 11 06:21:11.278: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0/0, changed state to down
000279: Oct 11 06:45:40.494: %PIM-5-NBRCHG: neighbor 172.20.56.5 UP on interface GigabitEthernet0/0/0
000280: Oct 11 06:45:40.495: %PIM-5-DRCHG: DR change from neighbor 0.0.0.0 to 172.20.56.6 on interface GigabitEthernet0/0/0
000281: Oct 11 06:45:41.392: %LINK-3-UPDOWN: Interface GigabitEthernet0/0/0, changed state to up
000282: Oct 11 06:45:42.393: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0/0, changed state to up
000283: Oct 11 06:45:48.276: %BGP-5-NBR_RESET: Neighbor 172.20.56.5 active reset (BGP Notification sent)
000284: Oct 11 06:45:48.276: %BGP-5-ADJCHANGE: neighbor 172.20.56.5 Up
000285: Oct 11 06:56:45.050: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up
000286: Oct 11 06:57:10.558: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up

NBRK_Cisco · ‎10-14-2018

bgp log-neighbor-changes

To enable logging of BGP neighbor resets, use the bgp log-neighbor-changes command in router configuration mode.

paul driver · ‎10-15-2018

Hello

what is your logging level?

sh logging

Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

Chad Parish · ‎10-16-2018

Buffer logging: level debugging

Logging levels should be correct to see the flap and I do see some. Just not sure why the one in question was not caught.

Guru Mysoruu · ‎10-16-2018

Hi Chad Parish,

Could you please share the output for the below commands. Since the earlier flaps are captured in the logs

looks like there is time zone difference. do you see any time differences, when the below commands are executed.

sh clock

sh hardware clock

sh run | in time