06-20-2017 08:34 PM - edited 03-08-2019 11:02 AM
%STORM_CONTROL-3-FILTERED:A Broadcast storm detected on Gi1/0/49. A packet filter action has been applied on the interface.
Also what is Packet filter action actually doing ?
06-21-2017 12:15 AM
Hello,
with storm control enabled on an interface, the interface monitors broadcasts received and blocks broadcasts for a specified time interval when a specified threshold is exceeded. Threshold and time intervals depend on the platform you are using.
The command
show storm-control
shows you the currently configured level. You can change the level using the interface command:
storm-control broadcast level x
06-21-2017 01:12 AM
Thanks for response, I have below level configured on interface. What level is recommended to avoid flooding of my buffer with aforementioned logs.
storm-control broadcast level 0.10
06-21-2017 01:16 AM
Hello,
a level of 50 is usually configured:
storm-control broadcast level 50
06-21-2017 06:51 AM
Okay, even if I change the broadcast level, still the Switch will show logs when packet filter action is applied.
Please help on how I could stop the logs being stored in buffer(logging buffered) for such actions.
06-21-2017 07:08 AM
Hello,
depending on your platform, try what options are available to either disable storm control traps on the interface:
Switch(config-if)# storm-control action trap
or globally disable the traps:
Switch(config)# snmp-server enable traps storm-control trap-rate 0
06-21-2017 07:23 AM
You could also block them from going to the buffer using discriminator as another option
logging buffered discriminator %STORM_CONTROL-3-FILTERED 10000
logging console discriminator %STORM_CONTROL-3-FILTERED
logging monitor discriminator %STORM_CONTROL-3-FILTERED
06-21-2017 07:56 AM
Mark,
nice option !
06-21-2017 08:26 AM
Thanks, will check and confirm tomorrow.
06-22-2017 02:27 AM
Hi George & Mark, thanks for your patience. I tried the discriminator and trap action on interface but after that no log is showing on Switch. Even admin down logs are not showing on 'sh log' output.
Found below output on Switch while configuring discriminator option.
Specified MD by the name %STORM_C is not found
Specified MD by the name STORM_CO is not found
I am using Cisco WS-C3560G-48PS Switch and just want to avoid the broadcast and multicast logs on my buffer so that other meaningful logs are available on buffer.
06-22-2017 04:06 AM
its supposed to that when configured but not block all logs are you surer on that , I just ran it on one of my switches it took fine as below and is working
when its enabled you get a separate section highlighted in logs where you can see how many of the discriminator messages its blocking
(config)#logging buffered discriminator %STORM_CONTROL-3-FILTERED 10000
Specified MD by the name %STORM_C is not found.
(config)#^Z
#sh logg
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
No Active Message Discriminator.
No Inactive Message Discriminator.
Console logging: level debugging, 406 messages logged, xml disabled,
filtering disabled
Monitor logging: level debugging, 0 messages logged, xml disabled,
filtering disabled
Buffer logging: level debugging, 406 messages logged, xml disabled,
filtering disabled
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
File logging: disabled
Persistent logging: disabled
No active filter modules.
Trap logging: level informational, 410 message lines logged
Logging to x.x.x.x (udp port 514, audit disabled,
authentication disabled, encryption disabled, link up),
410 message lines logged,
0 message lines rate-limited,
0 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering disabled
06-22-2017 04:37 AM
After applying discriminator option, I made an interface shutdown and no shut. But couldn't found the related logs for this in 'sh log' output when severity is configured informational.
Could you please check at your Switch once again for this.
02-02-2018 10:50 AM
I have same issue but it occurs only 2 different times on one particular interface. What is the cause of it and how can I fix this issue.
Is that the only solution to change to increase the storm-control broadcast level x?
Log:
Jan 21 17:03:26.302: %STORM_CONTROL-3-FILTERED: A Broadcast storm detected on x. A packet filter action has been applied on the interface.
Jan 30 17:49:39.096: %STORM_CONTROL-3-FILTERED: A Broadcast storm detected on x. A packet filter action has been applied on the interface.
02-02-2018 11:41 AM
Hello,
what is connected to that port ? Instead of trying to get rid of the log entries, try and find out what is causing the broadcast storms...
02-02-2018 12:30 PM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide