not receiving log messages

[Manoj Wadhwa]

Friends,

I have a cisco 2610 router, IOS version 11.3(8)T1. Though i have logging configured, the router does not show any log messages and i am not sure what the problem is. Plz find below the config that i have.

logging buffered 16384 debugging

logging trap notifications

logging facility local6

logging source-interface Loopback10

logging x.x.x.x

The lo10 is assigned with proper ip address and its status is up.

When i issue a "show log" command, below is the output

show log

Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)

Console logging: level debugging, 63 messages logged

Monitor logging: level debugging, 0 messages logged

Trap logging: level notifications, 21 message lines logged

Logging to x.x.x.x, 21 message lines logged

Buffer logging: level debugging, 63 messages logged

Log Buffer (16384 bytes):

Though the above output says that 63 messages logged, i dont see even a singloe message in the output. Any help in this regards is highly appreciated.

Regards,

Manoj

[Edison Ortiz]

If you don't see any log messages in the buffer, then someone had clear it with the 'clear log' command.

You can test logging is working by entering in config mode, make a small change, (i.e. the command "description test" under an interface) and exit out of it. You should see a new message under the logging.

[Richard Burts]

Manoj

I can think of 2 possibilities that might produce the symptoms that you describe.

- Is it possible that after entering the show log command and it displays the control information that you posted, that you hit some key other than the space bar or the enter key? Hitting any key other than space bar or enter key will stop the display.

- Is it possible that someone has entered the clear log command? This command will clear all of the entries from the logging buffered memory are start logging over again.

I would suggest that you log in to the router again, do something that will create a log entry (perhaps go into config t mode and then exit) and immediately do the show log command (being sure to press the space bar after the initial command entry). Try this and let us know the result.

HTH

Rick

[Manoj Wadhwa]

Hi Rick,

I have taken the output by pressing the space bar until i get the router prompt again. In regards to your second question, i have cleared the counter on one of the interfaces, but still it does not show up in the log.

NAME#clear count e0/0

Clear "show interface" counters on this interface [confirm]

NAME#show log

Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)

Console logging: level debugging, 63 messages logged

Monitor logging: level debugging, 0 messages logged

Trap logging: level notifications, 21 message lines logged

Logging to x.x.x.x, 21 message lines logged

Buffer logging: level debugging, 63 messages logged

Log Buffer (16384 bytes):

NAME#

[Edison Ortiz]

Clear counter won't generate a log message.

As explained by Rick and myself, you need to go into config mode.

[Manoj Wadhwa]

Edison,

Actually i dont have config access to that router, hence unable to perform that step. But as per my experience, i have found clear counters does generate log messages. Plz find below the output that i have taken from another router which has a similar logging configuration

TEST#clear count fa0/0

Clear "show interface" counters on this interface [confirm]

TEST#show log

Aug 6 03:35:29.220 INT: %CLEAR-5-COUNTERS: Clear counter on interface FastEthernet0/0 by XXXXXXX on vty0

TEST#

[Edison Ortiz]

I stand corrected.

If you don't have config access to that router, there is a possibility that your access is limited to see the show log output.

[Manoj Wadhwa]

Edison,

I will try to have someone make some config changes and later check the logs. Will keep you posted on this. Thanks!

Rgds,

Manoj

[Manoj Wadhwa]

Edison/ Rick,

I managed to make some config change on the router but still do not see the log message.

TEST#config t

Enter configuration commands, one per line. End with CNTL/Z.

TEST(config)#int e0/0

TEST(config-if)#des

TEST(config-if)#description Ethernet LAN Segment

TEST(config-if)#^Z

TEST#show log

Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)

Console logging: level debugging, 63 messages logged

Monitor logging: level debugging, 0 messages logged

Trap logging: level notifications, 21 message lines logged

Logging to X.X.X.X, 21 message lines logged

Buffer logging: level debugging, 63 messages logged

Log Buffer (16384 bytes):

TEST#

I also cleared the logging and tried to do some config changes again but still no luck

TEST#clear logging

Clear logging buffer [confirm]

TEST#show log

Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)

Console logging: level debugging, 63 messages logged

Monitor logging: level debugging, 0 messages logged

Trap logging: level notifications, 21 message lines logged

Logging to X.X.X.X, 21 message lines logged

Buffer logging: level debugging, 63 messages logged

Log Buffer (16384 bytes):

TEST# config t

Enter configuration commands, one per line. End with CNTL/Z.

TEST(config)#int e0/0

TEST(config-if)#description LAN Segment

TEST(config-if)#^Z

TEST#show log

Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)

Console logging: level debugging, 63 messages logged

Monitor logging: level debugging, 0 messages logged

Trap logging: level notifications, 21 message lines logged

Logging to X.X.X.X, 21 message lines logged

Buffer logging: level debugging, 63 messages logged

Log Buffer (16384 bytes):

TEST#

Kindly let me know your thoughts on this. Thanks again.

Regards,

Manoj

[Richard Burts]

Manoj

One thing I note that has been consistent since your first post: the number of messages logged in Buffer logging is 63:

Buffer logging: level debugging, 63 messages logged

It was 63 messages in your first post and it is 63 messages in your most recent post, even though you have done several things that should have generated messages to logging buffered. You indicate that you cleared the logging buffer, and I am guessing that someone had cleared the logging buffer, and the router is not writing new messages to the logging buffer.

This seems quite unusual. I suspect that there is something in the config, or perhaps it is some bug. I really would like to see the complete config of the router to see if there is something there that is affecting logging buffered.

HTH

Rick

[Manoj Wadhwa]

Rick,

I have attached the config (with some minute changes like removing the passwords). Hope this will help you further. Thanks!

Regards,

Manoj

[sundar.palaniappan]

Manoj,

One of the things that Rick alluded to in his post, IOS bug, is what I am supecting may be the issue here. I have come across this type of situation a handful of times on some managed devices that would indicate buffer logging counter incrementing but nothing would show up the log. If this indeed is a bug then a reload may cause the buffer logging to start working again.

HTH

Sundar

[Richard Burts]

Manoj

I do not see anything in the config that you posted that would explain the symptoms that you describe. The show log consistently indicates that 63 messages were sent to the logging buffer even though you have done some things that should have created new log messages.

I have seen a few situations where the behavior of the router was different from what the config indicated. In these cases a reload of the router successfully restored sync between the config and the behavior of the router. Is there any possibility that you could arrange for a reload of this router?

HTH

Rick

[Manoj Wadhwa]

Hi Sundar/ Rick,

Thank you for your valued suggestions. I will go by your advice and try to arrange for a router reboot. I will have to inform someone about this as this is at a remote location. I am not sure if this could be done before Thursday or Friday as this is a production router.... but anyways, i will try to make it as early as possible. I will let you know once i get the confirmation on timings for reboot and will update once it is one. Thanks again for your time. You guys are champs ;-)

Cheers!!!