syslog for interface up/down (flappin g) event

[sossie]

Hi all,

We operate networks in a factory environment. Sometimes we have some poor quality cabling and we can see in the log on the switch that the port is going up/down very often (ie not just because the attached device has been powered on/off).

I know we can have syslog events for interface up/down, but what I woudl like to do is log these events only if we see say "10 up or down events over the period of 5 minutes".

e.g I want a command like this:

"logging event link-status every 10 for 5"

This is kind of like the: "login on-failure log every 3"

Cheers, Simon.

[Richard Burts · Accepted solution]

Simon

I wonder if you could get the functionality you want by using an EEM script. EEM can watch for particular syslog messages such as line is down. You might be able to create some logic that would put entries into a table with a time stamp and watch for the table to accumulate 10 entries in 5 minutes.

HTH

Rick

[Rolf Fischer · Accepted solution]

Hi Simon,

there is also a build-in error-disable event in IOS called link-flapping:

show errdisable flap-values
ErrDisable Reason    Flaps    Time (sec)
-----------------    ------   ----------
pagp-flap              3       30
dtp-flap               3       30
link-flap              5       10

So here a link-flap event is triggerd when the link flaps 5 times in 10 seconds.

Most (maybe even all?) platforms allow you to change those values: https://supportforums.cisco.com/docs/DOC-4876

When errdisable detect link-flap is enabled and such an event occurs, the interface is shut down and a syslog-message is also send:

%PM-4-ERR_DISABLE: link-flap error detected on Gi4/1, putting Gi4/1 in err-disable state

If you don't like the idea of having to wait for the errdisable recovery-timer to re-activate the interface after such an event, you could perfectly use the syslog message for triggering a more sophisticated EEM applet or -script, like suggested by Rick.

HTH

Rolf

[sossie]

Thanks guys for the two helpful replies. I think I will try an EEM script. The err-disable linkflap setting is probably best left as is to do the job it was designed for.

Cheers, Simon.

[Rolf Fischer]

If your hardware supports it, you may find an optimized toolbox in the ESM (Embedded Syslog Manager).

"The Embedded Syslog Manager (ESM) feature provides a programmable framework that allows you to filter, escalate, correlate, route, and customize system logging messages prior to delivery by the Cisco IOS system message logger."

This "message counting example" looks very interesting, maybe you can modifiy it for your needs.

HTH

Rolf

[oscarmtz]

hi richard

I have configured three servers of syslog, in ASR 9010

logging x.x.x.x vrf(a)  severity info
logging x.x.x.x  severity info
logging x.x.x.x vrf(b) severity info

I have a request  for disable all events of interface up/down  only in server of vrf(b). How could I do it. Help me please

Regards,

Oscar