Message Format

This chapter describes how messages from your Catalyst 5000 series switch are formatted and how you can enable the System Message Log feature to send messages to the switch internal buffer and system console for display (and optionally, to a logging server on another system). Not all messages indicate problems; some messages are purely informational, while others help diagnose problems with communications lines, internal hardware, or the system software.

Messages are listed by the facility (hardware device, protocol, or a module or system software) that produces the messages. Within each facility, messages are listed by the severity level, from highest to lowest. Each message is followed by an explanation and a recommended action. Messages appear only when the system remains operational.

This chapter contains the following sections:

Message Structure

Messages are structured as follows:

facility-severity:description

Messages from the System Message Log are structured the same, but include this date/time stamp at the beginning of the message:

mm/dd/yyy:hh/mm/ss:facility-severity:description

where

mm/dd/yyy:hh/mm/ss

is the date and time of the error/event.

Both message types contain this information:

A facility code consists of two or more uppercase letters that indicate the reference facility to which the message refers. A facility can be a hardware device, a protocol, or a module of the system software. See Table 1-1.

**Table 1-1: Facility Codes**
Code	Facility
CDP	Cisco Discovery Protocol
DISL	Dynamic Inter-Switch Link
DRIP	Dual Ring Protocol
DVLAN	Dynamic VLAN¹
EARL	Enhanced Address Recognition Logic
FDDI	Fiber Distributed Data Interface²
FILESYS	Flash File System
IP	Internet Protocol Permit List
KERNEL	Kernel
Log_Error	Logical Link Control
MGMT	MGMT messages for TopN
Mcast	Multicast (CGMP/IGMP³) Snooping
MLS	Multilayer Switching
PAGP	Port Aggression Protocol
Protfilt	Protocol Filtering
PRUNING	VLAN Trunking Protocol Pruning
SNMP	Simple Network Management Protocol for Remote Monitoring
SNMP	Simple Network Management Protocol
SPANTREE	Spanning-Tree Protocol
SYS	System
TAC	Terminal Access Controller Access Control System
TCP	Transmission Control Protocol2
TELNET	Standard terminal emulation protocol in the TCP/IP⁴ protocol stack2
TFTP	Trivial File Transfer Protocol2
VMPS	VLAN Membership Policy Server
VTP	VLAN Trunking Protocol

¹ VLAN=virtual LAN
² Not covered in this publication
³ CGMP/IGMP=Cisco Group Management Protocol/Internet Group Management Protocol
⁴ TCP/IP=Transmission Control Protocol/Internet Protocol

A severity level is a single-digit from 0 to 7 that reflects the severity of the condition. The lower the number, the more serious the situation. See Table 1-2.

Table 1-2: Message Severity Levels

Severity Level	Description
0 - emergency	Unusable system
1 - alert	Immediate action required
2 - critical	Critical condition
3 - error	Error condition
4 - warning	Warning condition
5 - notification	Normal but significant condition
6 - informational	Informational message only
7 - debugging	Message that appears during debugging only

A description level text string describes the condition. Sometimes it contains detailed information about the event, including terminal port numbers, network addresses, or addresses that correspond to locations in the system memory address space. Because these variable fields can change from message to message, they are represented by short strings in square brackets ([ ]). A decimal number, for example, is represented as [dec]. See Table 1-3.

Table 1-3: Representation of Variable Fields in Messages

Representation	Type of Information
[dec]	Decimal
[chars]	Character string
[hex]	Hexadecimal integer

The following is a sample system message; an explanation of the message follows (see Table 1-3):

2/5/1997,18:31:15:SYS-5:Module 5 has been inserted

where

2/5/1997,18:31:15 is the date and time of the error (this appears if set for system log messaging).

SYS is the facility type.

5 is the severity level, indicating that it is a normal but significant condition.

Module 5 has been inserted is the message text.

System Message Log

Catalyst 5000 series switch System Message Log (syslog) software can save system messages in a log file or direct the messages to other devices. You can specify which system messages to save based on the facility type and the severity level of the message. These messages are saved in an internal buffer that can store up to 1024 system log messages in the Catalyst 5000 series switch. You can also save messages on UNIX servers that are configured properly. The syslog software reads the messages from the buffer and sends them to the specified destination.

With syslog, you can access system messages by logging in to the console through Telnet. This allows you to monitor system messages remotely from any workstation that supports the Telnet protocol.

The following is a sample system log error message; an explanation of the message follows:

3/17/1998,18:31:15:SYS-5:Module 5 has been inserted

where

3/17/1998,18:31:15 is the date and time of the error.

SYS is the facility type.

5 is the severity level, indicating that it is a normal but significant condition.

Module 5 has been inserted is the message text.

Default Configuration

Each Catalyst 5000 series switch ships with a default configuration. To view the default configuration, enter the show logging command. For an example screen showing the default configuration, see the "Default System Message Log Configuration" section.

When initializing, the Catalyst 5000 series switch displays a severity level 5 (notifications) startup message showing the status of each module and port:

Login sessions:3/24/1998,11:03:11:SYS-5:Module 1 is online. 3/24/1998,11:03:26:SYS-5:Port 1/1 has become trunk

After switch initialization, a severity level 6 (information) message shows Simple Network Management Protocol (SNMP) socket status information:

Login sessions:3/24/1998,13:59:26:SNMP-6:UDP socket [0] openedUNIX syslog servers:Sep 24 13:59:31 cat11-lnf.cisco.com :SNMP-6:UDP socket [0] opened

Note When the Catalyst 5000 series switch first initializes, the network is not connected until initialization completes. Therefore, the messages redirected to UNIX syslog servers are delayed up to 90 seconds .

System Message Log Procedures

The System Message Log has several configurable options as follows:

Default System Message Log Configuration

The Catalyst 5000 series switch ships with the default configuration shown in Table 1-4:

**Table 1-4: Default Configuration**
Configuration Parameters	Default Setting
System message logging to the console	Enabled
Syslog servers	None configured
System message logging to Telnet sessions	Enabled
Facility/severity level for system messages	disl/5 sys/5 all other facilities/2

When you first log on to the Catalyst 5000 series switch console, enter the show logging command to display the default configuration. After entering the show logging command, you see this display:

Console <enable> show logging 
Logging console:              enabled
Logging server:               disabled
Current Logging Session:      enabled
Facility            Server/Default Severity  Current Session Severity
-------------       -----------------------  ------------------------
cdp                 2                        2
mcast               2                        2
disl                5                        5
dvlan               2                        2
earl                2                        2
fddi                2                        2
ip                  2                        2
pruning             2                        2
snmp                2                        2
spantree            2                        2
sys                 5                        5
tac                 2                        2
tcp                 2                        2
telnet              2                        2
tftp                2                        2
vtp                 2                        2
vmps                2                        2
kernel              2                        2
filesys             2                        2
drip                2                        2
pagp                2                        2
mgmt                5                        5
mls                 5                        5
protfilt            2                        2
0(emergencies)        1(alerts)             2(critical)
3(errors)             4(warnings)           5(notifications)
6(information)        7(debugging)
Console>

Console Configuration

To change the default facility and severity levels from the default values, perform this task:

Task	Command
Set the default facility and severity level for system messages.	set logging level facility severity

To disable system message logging to the console, enter this command:

Console <enable> set logging console disable

syslog Daemon on UNIX syslog Server Configuration

Before system log messages can be sent to a UNIX syslog server, you must configure the syslog daemon on the UNIX server. To configure the syslog daemon on a 4.3 BSD UNIX system, log in as root and perform these steps:

Step 1 Add a line such as the following in the file /etc/syslog.conf:

local7.debug /var/log/myfile.log

Note

local7.debug

/var/log/

myfile.log.

/etc/syslog.conf

The Catalyst 5000 series switch sends messages according to specified facility types and severity levels. The local7 keyword specifies the UNIX logging facility. The messages from the Catalyst 5000 series switch are sent to local7. The debug keyword specifies the severity level of the condition being logged. UNIX systems can be set to receive all messages from the Catalyst 5000 series switch.

Step 2 Create the log file by entering these commands at the UNIX shell prompt:

$ touch /var/log/myfile.log$ chmod 666 /var/log/myfile.log

Step 3 Make the syslog daemon read the new changes by entering this command:

$ kill -HUP `cat /etc/syslog.pid`

syslog Server Configuration

Before system log messages can be sent to a UNIX syslog server, you must configure the syslog daemon on the UNIX server, as described in the section "Console Configuration." To configure the syslog servers, perform these steps:

Task	Command
Step 1 Add a syslog server to the configuration.¹	set logging server ip_addr
Step 2 Enable system message logging to configured syslog servers.	set logging server enable
Step 3 Set the facility and severity level for syslog server messages.	set logging level facility severity default

¹ You can configure a maximum of three syslog servers at any time.

To delete a syslog server from the configuration, enter this command:

Console <enable> clear logging server ip_addr

To disable system message logging to the configured syslog server, enter this command:

Console <enable> set logging server disable

T elnet Login Session Configuration

By default, Telnet login sessions to the Catalyst 5000 series switch are enabled and receive system messages based on the default facility and severity values. To configure Telnet login sessions, enter these commands:

To change the facility and severity values for Telnet login sessions, enter this command:

Console <enable> set logging level facility severity

To disable system message logging to the current Telnet login session, enter this command:

Console <enable> set logging session disable

To re enable system message logging to the current Telnet login session, enter this command:

Console <enable> set logging session enable

System Message Display

To display the current configuration for system messages, perform this task:

Task	Command
Display the current system message log configuration.	show logging

To display the first N system messages in the internal buffer of the Catalyst 5000 series switch, perform this task:

Task	Command
Display the first N messages in the buffer.	show logging buffer N

To display the last N system messages in the internal buffer of the Catalyst 5000 series switch, perform this task:

Task	Command
Display the last N messages in the buffer.	show logging buffer -N

Verification

To verify the System Message Log configuration, enter the show logging command. If you are verifying the System Message Log configuration for the console and the syslog server is disabled, the first two lines of output look as follows:

Console <enable> show logging
Logging console:            enabled
Logging server:            disabled

If you are verifying the System Message Log configuration for a Telnet login session, an additional line showing the Current Logging Session is displayed, as follows:

Console <enable> show logging
Logging console:            enabled
Logging server:             disabled
Current Logging Session:    enabled

Examples

This section provides examples for using the System Message Log commands to perform the following tasks:

To enable system message logging to configured syslog servers, enter this command:

Console <enable> set logging server enable
System logging messages will be sent to the configured syslog servers.

To add a new syslog server at IP address 171.69.192.205 to the system logging server table, enter this command:

Console <enable> set logging server 171.69.192.205
171.69.192.205 added to the System logging server table.

To enable system logging messages to the current login session, enter this command:

Console <enable> set logging session enable
System logging messages will be sent to the current login session.

To change the default facility to all and severity to 2, enter this command:

Console <enable> set logging level all 2 default
System logging facility <all> set to severity 2(alerts).

To change the severity for facilities to 1, enter this command:

Console <enable> set logging level all 1
System logging facility <all> set to severity 1(alerts).

Console <enable> show logging 
Logging console:              enabled
Logging server:               disabled
Current Logging Session:      enabled
Facility            Server/Default Severity  Current Session Severity
-------------       -----------------------  ------------------------
cdp                 1                        1
mcast               1                        1
disl                1                        1
dvlan               1                        1
earl                1                        1
fddi                1                        1
ip                  1                        1
pruning             1                        1
snmp                1                        1
spantree            1                        1
sys                 1                        1
tac                 1                        1
tcp                 1                        1
telnet              1                        1
tftp                1                        1
vtp                 1                        1
vmps                1                        1
kernel              1                        1
filesys             1                        1
drip                1                        1
pagp                1                        1
mgmt                1                        1
mls                 1                        1
protfilt            1                        1
0(emergencies)        1(alerts)             2(critical)
3(errors)             4(warnings)           5(notifications)
6(information)        7(debugging)

To set the facility to snmp and the severity level to 3 for the current session, enter this command:

Console <enable> show logging level snmp 3
System logging facility <snmp> set to severity 3 (errors).

To display the new System Message Log configuration, enter this command and note the new value for snmp under the Current Session Severity column:

Console <enable> show logging 
Logging console:              enabled
Logging server:               disabled
Current Logging Session:      enabled
Facility            Server/Default Severity  Current Session Severity
-------------       -----------------------  ------------------------
cdp                 1                        1
mcast               1                        1
disl                1                        1
dvlan               1                        1
earl                1                        1
fddi                1                        1
ip                  1                        1
pruning             1                        1
snmp                1                        3
spantree            1                        1
sys                 1                        1
tac                 1                        1
tcp                 1                        1
telnet              1                        1
tftp                1                        1
vtp                 1                        1
vmps                1                        1
kernel              1                        1
filesys             1                        1
drip                1                        1
pagp                1                        1
mgmt                1                        1
mls                 1                        1
protfilt            1                        1
0(emergencies)        1(alerts)             2(critical)
3(errors)             4(warnings)           5(notifications)
6(information)        7(debugging)
Console>

To display the first four messages in the internal buffer, enter this command:

Console <enable> show logging buffer 4
3/4/1998,13:52:46:SYS-5:Module 1 is online
3/4/1998,13:52:52:SYS-5:Module 5 is online
3/4/1998,13:52:54:SYS-5:Module 3 failed due to CBL0, CBL1, or CBL2 Error
3/4/1998,13:52:54:SYS-5:Module 3 failed configuration

To display the last four messages in the internal buffer, enter this command:

Console <enable> show logging buffer -4
3/4/1998,13:52:54:SYS-5:Module 3 failed configuration
3/4/1998,13:53:04:SYS-5:Module 4 is online
3/4/1998,13:53:31:SNMP-6:Subagent 2 connected
3/4/1998,13:54:45:SNMP-5:Cold Start Trap

Table of Contents

Message Format