Message Format

This chapter explains how messages are formatted for the Catalyst 5000 series switches and how the System Message Log feature allows you to send normal, but significant system messages to its internal buffer and to the system console for display.

Message Structure

Messages are structured as follows:

facility-severity:description

Messages from the System Message Log are structured the same, but include the following date/time stamp at the beginning of the message:

mm/dd/yyy:hh/mm/ss:facility-severity:description

where mm/dd/yyy:hh/mm/ss is the date and time the error/event occurred.

Both message types contain the following information:

FACILITY is a code consisting of two or more uppercase letters that indicate the reference facility to which the message refers. A facility can be a hardware device, a protocol, or a module of the system software. The facility codes are listed in Table 1-1.
SEVERITY is a single-digit code from 0 to 7 that reflects the severity of the condition. The lower the number, the more serious the situation. Table 1-2 lists the severity levels.

Table 1-1: Facility Codes

Code	Facility
SYS	System
CGMP	Cisco Group Management Protocol
VTP	VLAN Trunking Protocol
CDP	Cisco Discovery Protocol
EARL	Encoded Address Recognition Logic
SNMP	Simple Network Management Protocol
TAC	Terminal Access Controller
DISL	Dynamic ISL
IP	Internet Protocol
SPANTREE	Spanning-Tree Protocol
TCP	Transmission Control Protocol
TELNET	Standard terminal emulation protocol in the TCP/IP protocol stack

Table 1-2: Message Severity Levels

Severity Level	Description
0 - emergency	Unusable system
1 - alert	Immediate action required
2 - critical	Critical condition
3 - error	Error condition
4 - warning	Warning condition
5 - notification	Normal but significant condition
6 - informational	Informational message only
7 - debugging	Appears during debugging only

Description is a text string describing the condition. This part of the message sometimes contains detailed information about the event, including terminal port numbers, network addresses, or addresses that correspond to locations in the system memory address space. Because these variable fields can change from message to message, they are represented by short strings enclosed in square brackets ([ ]). A decimal number, for example, is represented as [dec]. Table 1-3 lists the representations of variable fields and the type of information in them.

Table 1-3: Representation of Variable Fields in Messages

Representation	Type of Information
[dec]	Decimal
[chars]	Character string
[string_new]	String and new line
[hex]	Hexadecimal integer
[int]	Integer
[string_sci]	String ddd.ddE+dd scientific notation

The following is a sample of a system error message; an explanation breakdown of the message follows (see also Table 1-3):

"2/5/1997,18:31:15:SYS-5:Module 5 has been inserted"

2/5/1997,18:31:15 is the date and time the error occurred.
SYS is the facility type.
5 is the severity level, indicating that it is a normal but significant condition.
"Module 5 has been inserted" is the message text.

System Message Log

Catalyst 5000 series switch software generates many different kinds of system messages. These messages can be saved in a log file or directed to other devices. You can specify which system messages should be saved based on the type of facility being reported on, as shown in Table 1-1, and the severity level of the message, as shown in Table 1-2. These messages are saved in a 1-KB internal buffer in the Catalyst 5000 series switch. They can also be saved on UNIX servers that have been configured properly. The syslog software then reads the messages from the buffer and sends them to the specified destination.

The System Message Log feature allows you to access system messages by logging in to the console using the Telnet protocol. In this way, you can monitor system messages remotely from any workstation that supports the Telnet protocol.

The following is a sample of a system log error message; an explanation breakdown of the message follows:

"2/5/1997,18:31:15:SYS-5:Module 5 has been inserted"

2/5/1997,18:31:15 is the date and time the error occurred.
SYS is the facility type.
5 is the severity level, indicating that it is a normal but significant condition.
"Module 5 has been inserted" is the message text.

Default Configuration

Each Catalyst 5000 series switch ships with a default system message logging configuration. To view the default configuration, enter the show logging command. For an example of a screen showing the default configuration, see the "Default System Message Log Configuration" section.

When initializing, the Catalyst 5000 series switch displays a severity level 5 (notifications) startup message showing the status of each module and port:

Login sessions:

9/24/1996,11:03:11:SYS-5:Module 1 is online. 8/22/1996,11:03:26:SYS-5:Port 1/1 has become trunk

After switch initialization, a severity level 6 (information) message shows Simple Network Management Protocol (SNMP) socket status information:

Login sessions:

9/24/1996,13:59:26:SNMP-6:UDP socket [0] opened

UNIX syslog servers:

Sep 24 13:59:31 cat11-lnf.cisco.com :SNMP-6:UDP socket [0] opened

Note When the Catalyst 5000 series switch is first initialized, the network is not connected until initialization completes. Therefore, the messages redirected to UNIX syslog servers are delayed up to 90 seconds.

System Message Log Procedures

The System Message Log feature has several configurable options. The following options are discussed in this chapter:

Default System Message Log Configuration

The Catalyst 5000 series switch is shipped with a default System Message Log configuration. The default configuration is as follows:

Configuration Parameter	Default Setting
System message logging to the console	Enabled
Syslog servers	None configured
System message logging to Telnet sessions	Enabled
Facility/severity level for system messages	disl/5 sys/5 all other facilities/2

When first logging on to the Catalyst 5000 series switch console, you can use the show logging command to display the default configuration. After entering the show logging command, you see this screen:

Console <enable> show logging 
Logging console:            enabled
Logging server:             disabled
Facility	Server/Default Severity	Current Session Severity
--------	---------------------	------------------------
cdp	2	2
cgmp	2	2
disl	5	5
earl	2	2
fddi	2	2
ip	2	2
pruning	2	2
snmp	2	2
spantree	2	2
sys	5	5
tac	2	2
0(emergencies)	1(alerts)	2(critical)
3(errors)	4(warnings)	5(notifications)
6(information)	7(debugging)

Console Configuration

You can change the default facility and severity levels from the default values with the set logging level command. To change the default facility and severity level for logging system messages to the console, perform this task:

Task	Command
Set the default facility and severity level for system messages.	set logging level facility severity

To disable system message logging to the console, use the set logging console disable command, as follows:

Console <enable> set logging console disable

Syslog Daemon on a UNIX Syslog Server Configuration

Before system log messages can be sent to a UNIX syslog server, you must configure the syslog daemon on the UNIX server. To configure the syslog daemon on a 4.3 BSD UNIX system, log in as root and perform these steps:

Step 1 Add a line such as the following in the file /etc/syslog.conf:

user.debug /var/log/myfile.log

Note In this example, there must be five tab characters between user.debug and /var/log/myfile.log. Refer to entries in the /etc/syslog.conf file for further examples.

The Catalyst 5000 series switch sends messages according to specified facility types and severity levels. The user keyword specifies the UNIX logging facility to be used. The messages from the Catalyst 5000 series switch are generated by user processes. The debug keyword specifies the severity level of the condition being logged. UNIX systems can be set to receive all messages from the Catalyst 5000 series switch.

Step 2 Create the log file by entering these commands at the UNIX shell prompt:

$ touch /var/log/myfile.log$ chmod 666 /var/log/myfile.log

Step 3 Make the syslog daemon read the new changes by entering the following command:

$ kill -HUP `cat /etc/syslog.pid`

Syslog Server Configuration

Before system log messages can be sent to a UNIX syslog server, you must configure the syslog daemon on the UNIX server. Refer to the preceding section, "Console Configuration." To configure the syslog servers, perform these tasks:

Task Command
Step 1 Add a syslog server to the configuration¹. set logging server ip_addr
Step 2 Enable system message logging to configured syslog servers. set logging server enable
Step 3 Set the facility and severity level for syslog server messages. set logging level facility severity default

1. A maximum of three syslog servers can be configured at any time.

To delete a syslog server from the configuration, use the clear logging server command:

Console <enable> clear logging server ip_addr

To disable system message logging to the configured syslog server, use the set logging server command:

Console <enable> set logging server disable

Telnet Login Session Configuration

By default, Telnet login sessions to the Catalyst 5000 series switch are enabled and receive system messages based on the default facility and severity values. To configure Telnet login sessions, use these commands:

To change the facility and severity values for Telnet login sessions, use the set logging level command, as follows:

Console <enable> set logging level facility severity

To disable system message logging to the current Telnet login session, use the set logging session command or the set logging console disable command:

Console <enable> set logging session disable

or

Console <enable> set logging console disable

To reenable system message logging to the current Telnet login session, enter the set logging session enable command or the set logging console enable command:

Console <enable> set logging session enable

or

Console <enable> set logging console enable

System Message Display

To display the current configuration for system messages, perform this task:

Task Command
Display the current system message log configuration. show logging
To display the first N system messages in the internal buffer of the Catalyst 5000 series switch, perform this task:

Task Command
Display the first N messages in the buffer. show logging buffer N
To display the last N system messages in the internal buffer of the Catalyst 5000 series switch, perform this task:

Task Command
Display the last N messages in the buffer. show logging buffer -N

Verification

To verify the System Message Log configuration, use the show logging command. If you are verifying the System Message Log configuration for the console and the syslog server is disabled, the first two lines of output look as follows:

Console <enable> show logging Logging console:            enabled Logging server:            disabled

If you are verifying the System Message Log configuration for a Telnet login session, an additional line showing the Current Logging Session is displayed, as follows:

Console <enable> show loggingLogging console:            enabled Logging server:             disabled Current Logging Session:    enabled

Examples

This section provides examples for using the System Message Log commands to perform the following tasks:

To enable system message logging to configured syslog servers, enter this command:

Console <enable> set logging server enableSystem logging messages will be sent to the configured syslog servers.

To add a new syslog server at IP address 171.69.192.205 to the system logging server table, enter this command:

Console <enable> set logging server 171.69.192.205171.69.192.205 added to the System logging server table.

To enable system logging messages to the current login session, enter this command:

Console <enable> set logging session enableSystem logging messages will be sent to the current login session.

To change the default facility to all and severity to 1, enter this command:

Console <enable> set logging level all 1 defaultSystem logging facility <all> set to severity 1(alerts).

To display the new System Message Log configuration, enter this command and note the new values in the Server/Default Severity and Current Session Severity columns:

Console <enable> show logging Logging console:            enabled Logging server:             disabled Facility Server/Default Severity Current Session Severity -------- --------------------- ------------------------ cdp 1 1 cgmp 1 1 disl 1 1 earl 1 1 fddi 1 1 ip 1 1 pruning 1 1 snmp 1 1 spantree 1 1 sys 1 1 tac 1 1 0(emergencies) 1(alerts) 2(critical) 3(errors) 4(warnings) 5(notifications) 6(information) 7(debugging)

To set the facility to snmp and the severity level to 3 for the current session, enter this command:

Console <enable> set logging level snmp 3System logging facility <snmp> set to severity 3(errors).

To display the new System Message Log configuration, enter this command and note the new value for snmp under the Current Session Severity column:

Console <enable> show logging Logging console:            enabled Logging server:             disabled Current Logging Session:    enabled Facility Server/Default Severity Current Session Severity -------- --------------------- ------------------------ cdp 2 2 cgmp 2 2 disl 5 5 earl 2 2 fddi 2 2 ip 2 2 pruning 2 2 snmp 2 3 spantree 2 2 sys 5 5 tac 2 2 0(emergencies) 1(alerts) 2(critical) 3(errors) 4(warnings) 5(notifications) 6(information) 7(debugging)

To display the first four messages in the internal buffer, enter this command:

Console <enable> show logging buffer 411/4/1996,13:52:46:SYS-5:Module 1 is online 11/4/1996,13:52:52:SYS-5:Module 5 is online 11/4/1996,13:52:54:SYS-5:Module 3 failed due to CBL0, CBL1, or CBL2 Error 11/4/1996,13:52:54:SYS-5:Module 3 failed configuration

To display the last four messages in the internal buffer, enter this command:

Console <enable> show logging buffer -411/4/1996,13:52:54:SYS-5:Module 3 failed configuration 11/4/1996,13:53:04:SYS-5:Module 4 is online 11/4/1996,13:53:31:SNMP-6:Subagent 2 connected 11/4/1996,13:54:45:SNMP-5:Cold Start Trap

Task	Command
Step 1 Add a syslog server to the configuration¹.	set logging server ip_addr
Step 2 Enable system message logging to configured syslog servers.	set logging server enable
Step 3 Set the facility and severity level for syslog server messages.	set logging level facility severity default

Table of Contents

Message Format

Default Configuration

Default System Message Log Configuration

Console Configuration

Syslog Daemon on a UNIX Syslog Server Configuration

Syslog Server Configuration