Bottom of Log display

[cisco_lite]

If the log display 'show log' is long and I need to jump to the bottom of display rather than scrolling down, is that possible ?

[Giuseppe Larosa · Accepted solution]

Hello Cisco_Lite,

if you use datetime for timestamps you can do something like

sh log | inc Mar 12

or

sh log | begin Mar 12

this allows to go to the last lines of the buffer

note:

in the first days of mounth there are two spaces between mounth (expressed as 3 letters) and the day number

so you need to use

sh log | inc Mar 9

example:

SW-MI-MCN-C-7>sh log | inc Mar 12

Mar 12 02:28:58: %SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port GigabitEthernet0/27 on VLAN0001.

Mar 12 02:28:58: %SPANTREE-2-LOOPGUARD_UNBLOCK: Loop guard unblocking port GigabitEthernet0/27 on VLAN0001.

Mar 12 07:37:25: %SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port GigabitEthernet0/28 on VLAN0001.

Mar 12 07:37:25: %SPANTREE-2-LOOPGUARD_UNBLOCK: Loop guard unblocking port GigabitEthernet0/28 on VLAN0001.

SW-MI-MCN-C-7>

I use this very often.

be aware that this can filter some messages so when you are in doubt use the begin option

Hope to help

Giuseppe

[Eric The Red]

3850#sh log | inc May 2
3850#sh log | inc May  2
May  2 19:10:42.043: %LINK-5-CHANGED: Interface GigabitEthernet1/0/1, changed state to administratively down

There really needs to be a better command to go to the bottom of the output.

As seen above, I had to put two spaces between May and 2 for the command to work properly.

I'm hoping for something more Linux-y, Cisco!

like the tail command, which shows the last 10 entries in the file (by default).

[Linux-host]# cat /var/log/messages | tail
May  2 15:20:01 Linux-host crond[18082]: (root) CMD (/usr/lib/sa/sa1 1 1)
May  2 15:29:28 Linux-host db daemon[6498]: updater started -1778637296
May  2 15:29:31 Linux-host db daemon[6498]: updater exited -1776017296
May  2 15:29:31 Linux-host db daemon[6498]: update took -4292.35 sec
May  2 15:29:31 Linux-host db daemon[6498]: update is finished, using new DB
May  2 15:30:01 Linux-host crond[23396]: (root) CMD (/usr/lib/sa/sa1 1 1)
May  2 15:39:53 Linux-host sshd[28626]: Address 10.77.8.40 maps to host.domain.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
May  2 15:39:56 Linux-host sshd[28626]: Accepted password for myuser from 10.77.8.40 port 55740 ssh2
May  2 15:39:56 Linux-host sshd[28626]: pam_unix(sshd:session): session opened for user myuser by (uid=0)
May  2 15:40:01 Linux-host crond[28740]: (root) CMD (/usr/lib/sa/sa1 1 1)
[Linux-host]#

or you could just run this command:

[Linux-host]# tail /var/log/messages

I listed the cat command because it is roughly equivalent

Here's what I would like to see as a command option from Cisco:

sh log | tail

interesting.... I tried the tail command on a 3850 switch and got this output:

3850#tail ?
The command you have entered is available in the IOS.sh.
However, the shell is currently disabled. You can enable
it on this terminal by typing
   'term shell'
You can also enable it for all terminals by configuring the
   'shell processing full'
command. There is additional information in the man command.
For more information, enable shell, and then enter:
'man IOS.sh'
 

aha!  this worked !! (see below)

(even though tail is not listed as an option on the command)

3850#term shell

3850#sh log | ?
  append    Append redirected output to URL (URLs supporting append operation
            only)
  begin     Begin with the line that matches
  count     Count number of lines which match regexp
  exclude   Exclude lines that match
  format    Format the output using the specified spec file
  include   Include lines that match
  redirect  Redirect output to URL
  section   Filter a section of output
  tee       Copy output to URL

3850#sh log | tail
*Mar 24 08:17:32.649: %SYS-6-CLOCKUPDATE: System clock has been updated from 03:17:32 EST Mon Mar 24 2014 to 04:17:32 EDT Mon Mar 24 2014, configured from console by vty0. (3850-2)
Mar 24 15:27:48.976: %SYS-5-CONFIG_I: Configured from console by myuser on vty1 (10.77.8.40)
Mar 24 16:23:40.601: %CRYPTO-6-AUTOGEN: Generated new 768 bit key pair

<output omitted for brevity and security - but there were 10 entries !>
May  2 19:10:57.132: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to down

3850#

[Marvin Rhoads]

On IOS I use "service sequence-numbers" in my configs and then (after the first long log output) I use "show log | b <last sequence number I want to start from>".

I didn't know there was an undocumented "tail" operand. Good find!

In NX-OS, you can use the "last" operand - e.g "show logging last 20"

[Brian Green]

The best way I have found to do this is by enabling the shell processing feature.

you can turn this on globally by using

"shell processing enable" in global configuration mode

to turn it on just for the session you can use

"terminal shell" from global exec mode

once this is enabled, you can do 

show logging | tail 

or 

show logging | tail # (where # is how many lines you wish to display)

[slonik220393]

Thank you and Eric The Red, it's just great. Older IOS lacks sh logg revers very much, but it works the same way. A little clarification, "tail" will not appear in tooltips.

[clayton.beaudin]

I know this is super old, but I struggled to find a good answer for too long and thought I would share in case others come across this page looking for something similar.

I wanted to go right to the end but still be able to scroll back endlessly, you can disable the paging feature by setting your terminal length to 0 which will just spit out the entire log to the terminal without having to page through to the end.

# terminal length 0

# show log

More details available here: https://community.cisco.com/t5/networking-documents/show-the-complete-configuration-without-breaks-pauses-on-cisco/ta-p/3115114