cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2826
Views
0
Helpful
17
Replies

How to remove below logs from Cisco Switch ?

Sumit Mor
Level 1
Level 1

 %STORM_CONTROL-3-FILTERED:A Broadcast storm detected on Gi1/0/49. A packet filter action has been applied on the interface.

Also what is Packet filter action actually doing ?

17 Replies 17

Hello,

with storm control enabled on an interface, the interface monitors broadcasts received and blocks broadcasts for a specified time interval when a specified threshold is exceeded. Threshold and time intervals depend on the platform you are using.

The command

show storm-control

shows you the currently configured level. You can change the level using the interface command:

storm-control broadcast level x

Thanks for response, I have below level configured on interface. What level is recommended to avoid flooding of my buffer with aforementioned logs.

storm-control broadcast level 0.10

Hello,

a level of 50 is usually configured:

storm-control broadcast level 50

Okay, even if I change the broadcast level, still the Switch will show logs when packet filter action is applied.

Please help on how I could stop the logs being stored in buffer(logging buffered) for such actions.

Hello,

depending on your platform, try what options are available to either disable storm control traps on the interface:

Switch(config-if)# storm-control action trap

or globally disable the traps:


Switch(config)# snmp-server enable traps storm-control trap-rate 0

You could also block them from going to the buffer using discriminator as another option

logging buffered discriminator %STORM_CONTROL-3-FILTERED 10000
logging console discriminator  %STORM_CONTROL-3-FILTERED
logging monitor discriminator  %STORM_CONTROL-3-FILTERED

Mark,

nice option ! 

Thanks, will check and confirm tomorrow.

Hi George & Mark, thanks for your patience. I tried the discriminator and trap action on interface but after that no log is showing on Switch. Even admin down logs are not showing on 'sh log' output.

Found below output on Switch while configuring discriminator option.

Specified MD by the name %STORM_C is not found

Specified MD by the name STORM_CO is not found

I am using Cisco WS-C3560G-48PS Switch and just want to avoid the broadcast and multicast logs on my buffer so that other meaningful logs are available on buffer.

its supposed to that when configured but not block all logs are you surer on that , I just ran it on one of my switches it took fine as below and is working

when its enabled you get a separate section highlighted in logs where you can see how many of the discriminator messages its blocking

(config)#logging buffered discriminator %STORM_CONTROL-3-FILTERED 10000
Specified MD by the name %STORM_C is not found.

(config)#^Z
#sh logg
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.


    Console logging: level debugging, 406 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging:  level debugging, 406 messages logged, xml disabled,
                     filtering disabled
    Exception Logging: size (4096 bytes)
    Count and timestamp logging messages: disabled
    File logging: disabled
    Persistent logging: disabled

No active filter modules.

    Trap logging: level informational, 410 message lines logged
        Logging to x.x.x.x (udp port 514,  audit disabled,
              authentication disabled, encryption disabled, link up),
              410 message lines logged,
              0 message lines rate-limited,
              0 message lines dropped-by-MD,
              xml disabled, sequence number disabled
              filtering disabled

After applying discriminator option, I made an interface shutdown and no shut. But couldn't found the related logs for this in 'sh log' output when severity is configured informational.

Could you please check at your Switch once again for this.

I have same issue but it occurs only 2 different times on one particular interface. What is the cause of it and how can I fix this issue. 

Is that the only solution to change to increase the storm-control broadcast level x?

Log:

Jan 21 17:03:26.302: %STORM_CONTROL-3-FILTERED: A Broadcast storm detected on x. A packet filter action has been applied on the interface.
Jan 30 17:49:39.096: %STORM_CONTROL-3-FILTERED: A Broadcast storm detected on x. A packet filter action has been applied on the interface.

 

Hello,

 

what is connected to that port ? Instead of trying to get rid of the log entries, try and find out what is causing the  broadcast storms...

Cisco 4500x is connected to nortel 5520 switch
Review Cisco Networking for a $25 gift card