Output of Interface which is connected to Firewall

[ITexpert]

Hello Guys, @Julio E. Moisa @Francesco Molino @Joseph W. Doherty  @Leo Laohoo  @Richard Burts following is the output of trunk interface which is connected with Firewall.  

#show interfaces g4/43
GigabitEthernet4/43 is up, line protocol is up (connected)
Hardware is C6k 1000Mb 802.3, address is 0023.ebb8.4c42 (bia 0023.ebb8.4c42)
MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
reliability 255/255, txload 2/255, rxload 15/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseT
input flow-control is off, output flow-control is off
Clock mode is auto
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:04, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 3731
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 62429000 bits/sec, 7405 packets/sec
5 minute output rate 10335000 bits/sec, 4405 packets/sec
46869097813 packets input, 53268232790730 bytes, 0 no buffer
Received 50275896 broadcasts (579477 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
25358597028 packets output, 5554705026515 bytes, 0 underruns
0 output errors, 0 collisions, 3 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 PAUSE output
0 output buffer failures, 0 output buffers swapped out

I can see the ouput drops and Interface resets,   I want to know when these things happen, How I will know when the reset happen and how it happens ?

sh logs doesnt work on 6504E switch ?

Thanks

[Joseph W. Doherty]

Show log should work on a 6504E. BTW, what sup and IOS?

Logging might record an interface reset, although correct logging level might need to be set.

As for output drops, that may require some form on-going monitoring, either external from a SNMP management host or perhaps from an on-board EEM script.

[ITexpert]

Hello @Joseph W. Doherty,

show logging is working, but i want to verify the status of uplink port from last 24 hours.  I want to verify if that port goes up and down in last 24 hours .

I always login with ssh , how it will record an interface reset . please explain ?

 please explain on-board EEM script ?

[Joseph W. Doherty · Accepted solution]

"how it will record an interface reset . please explain ?"

I'm not sure. It may show in system log as the interface going down/up. Rick mentions your interface resets might be caused by congestion. Perhaps, although I would expect it to be something other than "ordinary" interface drop congestion.

"please explain on-board EEM script ?"

If it's supported on your platform, it should be documented in the relevant IOS manuals. There also used to be (?) a support forum dedicated to the subject, but I'm not finding that now (since the last site restructure?).

[Richard Burts]

I agree with Joseph that an ordinary interface drop is different from what causes an interface reset. But I do wonder if something is impacting processing of outbound frames on that interface. Some of those frames are dropped and they show up in the interface counter. But perhaps some other frames are delayed in some way that they are not dropped, are not successfully sent within a time limit and result in interface reset.

HTH

Rick

[Joseph W. Doherty]

"But I do wonder if something is impacting processing of outbound frames on that interface."

Yup, seems possible.

From the (little that I found) documentation that I've read on interface resets, it does seem outbound issues might indeed cause an interface reset; I recall mention made of lack of buffers.

I suspect what exactly might cause an interface reset might vary per platform and/or IOS version.

[Richard Burts]

I am glad that our explanations have been helpful. Thank you for marking this question as solved. This will help other participants in the community to identify discussions which have helpful information. I look forward to other questions that you will post.

HTH

Rick

[Leo Laohoo]

Look at the amount of "Total Output Drops". Compare this value against the total Packet Input and/or the total Packet Output. This is a very, very tiny value.
Is the Total Output Drops incrementing or not?

[Richard Burts · Accepted solution]

The basic definition of interface reset is

Number of times an interface is completely reset. This may occur if packets that are queued for transmission were not sent within several seconds.

The drops probably are related to congestion on the interface. And my guess is that the interface congestion may have caused some packets to not be transmitted in time and these may be your interface resets.

HTH

Rick