Showing results for 
Search instead for 
Did you mean: 

CRC and other port errors to syslog



We have a bunch of 2911 and 4331 (and a few 2800 left) routers in branch offices around the world. 

Is there a way to get these routers to log when port errors occur? Like any input/output interface errors, especially CRC/FCS? 

Or is the only option to poll this info with snmp (or cli) ? 


Georg Pauwen
VIP Master VIP Master
VIP Master



you could run a simple EEM script. The script below would run every 60 seconds and generate a syslog message for CRC, input, and output errors for all Ethernet interfaces. It also includes an action to clear the log after 30 seconds, in order to avoid filling up the buffers:


event manager applet SYSLOG
event timer watchdog time 60
action 1 cli command "enable"
action 2 cli command "sh interfaces | include Ethernet|CRC|input errors|output errors"
action 3 syslog msg "$_cli_result"

action 4.0 wait 30

action 5.0 cli command "clear log" pattern "confirm"

action 6.0 cli command "y"

action 7.0 cli command "end"

Hello Georg,

                  Thanx for this script, I intend to use it, but when I tested it the output was just 

May 25 11:09:34: %HA_EM-6-LOG: SYSLOG: EFTA-2960x-EDGE30#
May 25 11:10:33: %HA_EM-6-LOG: SYSLOG: EFTA-2960x-EDGE30#
May 25 11:11:34: %HA_EM-6-LOG: SYSLOG: EFTA-2960x-EDGE30#
May 25 11:12:33: %HA_EM-6-LOG: SYSLOG: EFTA-2960x-EDGE30#

I think this log occures each time an interface error ok, correct?

also as you can see, the interface number has not been mentioned, how to add it please?

switch applied to c2960x and 2960s, ios-xe 9200

Dan Frey
Cisco Employee
Cisco Employee

Attached is an EEM TCL policy that I believe will do what you want.  The policy runs every 5 minutes (or can run manually) and captures input and output errors and CRC errors and compares them to the previous counter (last time the script ran 5 minutes ago).   If the counters increment then send a syslog.   The first time the script runs there are no previous counters so it will not send any syslog.  The syslog messages look like this and it runs this for every interface on the platform that has the error counters.

*May 25 22:50:00.966: %HA_EM-6-LOG: monitor_interface_errors.tcl: Interface GigabitEthernet1 has 20656 input errors (35 input errors this iteration)
*May 25 22:50:01.593: %HA_EM-6-LOG: monitor_interface_errors.tcl: Interface GigabitEthernet3 has 2019 input errors (4 input errors this iteration)
*May 25 22:50:01.906: %HA_EM-6-LOG: monitor_interface_errors.tcl: Interface GigabitEthernet4 has 18281 input errors (40 input errors this iteration)
*May 25 22:55:00.963: %HA_EM-6-LOG: monitor_interface_errors.tcl: Interface GigabitEthernet1 has 20758 input errors (102 input errors this iteration)
*May 25 22:55:01.588: %HA_EM-6-LOG: monitor_interface_errors.tcl: Interface GigabitEthernet3 has 2029 input errors (10 input errors this iteration)
*May 25 22:55:01.902: %HA_EM-6-LOG: monitor_interface_errors.tcl: Interface GigabitEthernet4 has 18370 input errors (89 input errors this iteration)
*May 25 23:00:00.964: %HA_EM-6-LOG: monitor_interface_errors.tcl: Interface GigabitEthernet1 has 20861 input errors (103 input errors this iteration)
*May 25 23:00:01.489: %HA_EM-6-LOG: monitor_interface_errors.tcl: Interface GigabitEthernet3 has 2039 input errors (10 input errors this iteration)
*May 25 23:00:01.803: %HA_EM-6-LOG: monitor_interface_errors.tcl: Interface GigabitEthernet4 has 18460 input errors (90 input errors this iteration)

The instructions to load the tcl file are in the comments section of the script.

- Dan

Hello Dan,

              Thank you so much Dan for the file, I will apply and feedback you.

thank you so much again.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: