Cisco 1700 Series Router Logging

[Matt.Fields]

I want to be able log when an interface on my router goes down and why it goes down. I do not have an external destination for these logs to go to so I would like them to be saved in the buffer. How would you enable this logging and how would your retreive these logs once they build up in the buffer?

Thanks

[Harold Ritter]

You would use the "logging buffered" command in global configuration mode to enable logging and the "sh logging" command to show the buffered logs.

Hope this helps,

[Richard Burts]

Harold is exactly correct that logging buffered will enable writing log messages to the buffer. And that show logging will display the log messages.

If you want to save the messages you can use cut and paste when you view the messages on the router and paste them into a file on your PC.

Be aware that the logging buffer is a wrap-around buffer. When it gets full it wraps around and newest messages over-write the oldest messages. So it is temporary storage not permanent storage for log messages.

There is an optional parameter in the logging buffered command that allows you to specify the size of the logging buffer. If you wish to do so you can allocate additional space to the logging buffer. This will allow it to run longer before it wraps around and starts over-writing messages.

HTH

Rick

[Matt.Fields]

Ok, that seemed to work but the log messages that I am getting are not detail (it is just saying Serial0 up and down). I have logging in debug mode, which I think is the most detailed logging. I have a CSU/DSU modular card as my Serial0 interface and the T1 coming into it keeps going up and down. The ISP said that I need detailed logs on that interface to help troubleshoot.

[paddyxdoyle]

Hi,

Have a look through the following link on debugging serial lines, specifically for the "debug commands".

http://www.cisco.com/en/US/tech/tk713/tk628/technologies_tech_note09186a00800a758d.shtml

When you enter these on the CLI of your device and have "logging buffered debugging" then any output generated from the debug commands will be logged.

The problem you will have as Rick mentions is that the output from these commands can be quite verbose and there is a danger of the logs wrapping and you losing this information.

So i think you should persue the idea of setting up a syslog server, you can get freeware windows syslog server or use a Unix box if you have one sitting around, there is a guide on cisco.com for setting up a Unix syslog server and logging to it from Cisco devices.

If you don't have a server to play with then i use 3cdeamon on my PC which is a useful utility from 3com that has a syslog server built in and is very easy to set up.

ftp://ftp.3com.com/pub/utilbin/win32/3cdv2r10.zip

Good Luck

Paddy

[peterledwidge]

Hello,

Is this a new T1 or has it been working previously? If it had been working properly then

the ISP need to eliminate a transmission issue

(llopback tests).

You can try debug serial interface but this has impact on router performance so should be used carefully.

If necessary,

Here are some troubleshooting guides for the 1700 series WAN interfaces

http://www.cisco.com/en/US/products/hw/modules/ps3129/prod_tech_notes_list.html

Best of luck

[Richard Burts]

Do the log messages indicate that the interface is going up and down or that the line protocol is going up and down? If the interface is going up and down then you are probably looking at some kind of hardware issue or provider problem. If the line protocol is goig up and down then you may be looking at an issue with clocking or of failure of keepalive (possibly an encapsulation mismatch between the two ends).

Perhaps you could post of the messages and we could see better what the issue may be.

If you are doing debug and the output is wrapping around you might consider seeing if your terminal emulator has an option to log sessions. If it does I would suggest that you enable the logging session option, telnet to the router, get to privilege more, do terminal monitor (so that the messages will also come to your terminal session), and let the session log capture the messages.

HTH

Rick

[Matt.Fields]

Logs

*Mar 1 03:28:37.647: %LINK-3-UPDOWN: Interface Serial0, changed state to down

*Mar 1 03:28:38.647: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, c

hanged state to down

*Mar 1 03:28:49.663: %LINK-3-UPDOWN: Interface Serial0, changed state to up

*Mar 1 03:28:50.663: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, c

hanged state to up

*Mar 1 03:29:00.663: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, c

hanged state to down

*Mar 1 03:29:20.663: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, c

hanged state to up

*Mar 1 04:14:39.518: %LINK-3-UPDOWN: Interface Serial0, changed state to down

*Mar 1 04:14:40.518: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, c

hanged state to down

*Mar 1 04:14:51.534: %LINK-3-UPDOWN: Interface Serial0, changed state to up

*Mar 1 04:14:52.534: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, c

hanged state to up

*Mar 1 04:15:02.534: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, c

hanged state to down

*Mar 1 04:15:42.534: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, c

hanged state to up

Interface

Serial0 is up, line protocol is up

Hardware is PQUICC with Fractional T1 CSU/DSU

Description: Internet T1

Internet address is ************/24

MTU 1500 bytes, BW 1536 Kbit, DLY 20000 usec,

reliability 255/255, txload 1/255, rxload 3/255

Encapsulation FRAME-RELAY IETF, loopback not set

Keepalive set (10 sec)

LMI enq sent 8492, LMI stat recvd 8570, LMI upd recvd 0, DTE LMI up

LMI enq recvd 0, LMI stat sent 0, LMI upd sent 0

LMI DLCI 1023 LMI type is CISCO frame relay DTE

Broadcast queue 0/64, broadcasts sent/dropped 13/0, interface broadcasts 0

Last input 00:00:00, output 00:00:00, output hang never

Last clearing of "show interface" counters 23:41:11

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 20

Queueing strategy: fifo

Output queue: 0/40 (size/max)

5 minute input rate 22000 bits/sec, 4 packets/sec

5 minute output rate 4000 bits/sec, 4 packets/sec

356912 packets input, 196109457 bytes, 0 no buffer

Received 0 broadcasts, 0 runts, 0 giants, 0 throttles

10 input errors, 0 CRC, 8 frame, 0 overrun, 0 ignored, 2 abort

312143 packets output, 46851217 bytes, 0 underruns

0 output errors, 0 collisions, 11 interface resets

0 output buffer failures, 0 output buffers swapped out

33 carrier transitions

DCD=up DSR=up DTR=up RTS=up CTS=up