Change severity for certain log messages

[Matt Glosson]

I have a 3560 running 12.2(55)SE3 that is constantly displaying in the log:

%SFF8472-5-THRESHOLD_VIOLATION: Gi1/1: Rx power low alarm; Operating value: -28.2 dBm, Threshold value: -22.0 dBm.

It is at a remote location and at some point we'll get out there to try cleaning the fiber connectors, but before that happens I would like to relegate this message to "debug" so it doesn't fill up the log buffer. "show interface" has zero send or receive errors so this issue isn't critical at the moment.

I know on an ASA you can easily change a particular message's severity (e.g., "logging message 713900 level debugging") but I can't figure out how to do this in IOS.

Thanks

[Richard Burts]

As you mention there are some platforms that do support changing the severity level of specific log messages. But I do not believe that the 3560 supports this.

HTH

Rick

[Matt Glosson]

Based on some direction I found here, it seems that the only way to filter is using a tcl script. Fortunately the page has great instructions. Here's what I ended up with:

logfilter.tcl:

if { [string compare -nocase THRESHOLD_VIOLATION $::mnemonic ] == 0 } {
 return ""
} else {
 return $::orig_msg
}

The buffered logging configuration looks like this:

logging filter flash:logfilter.tcl
logging buffered filtered informational

Unfortunately it seems that you can't set a filter for the buffered log and define the buffer size at the same time (logging buffered 16384 filtered informational doesn't work). Weird.

[mario.jost]

The problem with this script is, you only search with the TCL to get your desired log, and then apply the new severity level via the logging buffered filtered command. Solution is, to overwrite the severity level in the TCL script itself. That way you can still apply your buffered size and you gain more freedom in changing the severity level of different log entries to your desire. You dont have to change all entries that match the TCL script with the same severity level. You can find the script attached. What you would need for your environment is something like:

if { $::facility == "SFF8472" && $::mnemonic == "THRESHOLD_VIOLATION" }
{
      set incr sev_index [ string first $::mnemonic $::orig_msg ] -2
      return [string replace $::orig_msg $sev_index $sev_index 6]
}

There is a help included in the script that should get you started. Then, you can still apply your buffer size

logging filter flash:filter.tcl
logging buffered filtered 16384

Hope im not too late with this.