Configuring Network Management

Note For complete syntax and usage information for the commands used in this chapter, refer to the Catalyst 5000 Series Command Reference publication.

This chapter consists of these sections:

Using SNMP

These sections describe how to use the Simple Network Management Protocol (SNMP) on the Catalyst 5000 series switches:

Understanding SNMP

The components of SNMP network management fall into three categories:

Managed devices (such as a Catalyst 5000 series switch)
SNMP agents and management information bases (MIBs), including Remote Monitoring (RMON) MIBs, which run on managed devices
SNMP management applications, such as CiscoWorks for Switched Internetworks (CWSI ), which communicate with agents to get statistics and alerts from the managed devices

Note

SNMP network management uses these SNMP agent functions:

Accessing a MIB variable---This function is initiated by the SNMP agent in response to a request from the NMS. The agent retrieves the value of the requested MIB variable and responds to the NMS with that value.
Setting a MIB variable---This function is also initiated by the SNMP agent in response to a message from the NMS. The SNMP agent changes the value of the MIB variable to the value requested by the NMS.
SNMP trap---This function is used to notify an NMS that a significant event has occurred at an agent. When a trap condition occurs, the SNMP agent sends an SNMP trap message to any NMSs specified as the trap receivers, under these conditions:
- When a port or module goes up or down
- When temperature limitations are exceeded
- When there are spanning-tree topology changes
- When there are authentication failures
- When power supply errors occur
SNMP community strings---SNMP community strings authenticate access to MIB objects and function as embedded passwords:
- Read-only---Gives read access to all objects in the MIB except the community strings, but does not allow write access
- Read-write---Gives read and write access to all objects in the MIB, but does not allow access to the community strings
- Read-write-all---Gives read and write access to all objects in the MIB, including the community strings

Note The community string definitions on your NMS must match at least one of the three community string definitions on the switch.

Catalyst 5000 series switches are managed devices that support SNMP network management with the following features:

SNMP traps (see the "Configuring SNMP from the CLI" section)
RMON on the supervisor engine module (see the "Using RMON" section)
RMON and RMON2 for all VLAN types on an external SwitchProbe device

Note For more information about MIB objects supported on the Catalyst 5000 series switches, refer to "Enterprise MIB User Quick Reference," on Cisco Connection Online (http://www.cisco.com).

SNMP Default Configuration

Table 15-1 describes the SNMP default configuration.

Feature	Default Setting
SNMP community strings	Read-Only: Public Read-Write: Private Read-Write-all: Secret
SNMP trap receiver	None configured
SNMP traps	None enabled

Table 15-1: SNMP Default Configuration

Feature Default Setting

SNMP community strings

Read-Only: Public

Read-Write: Private

Read-Write-all: Secret

SNMP trap receiver

None configured

SNMP traps

None enabled

Configuring SNMP from a Network Management System

To configure SNMP from a NMS, refer to the NMS documentation (see the "Using CWSI and CRM with Catalyst 5000 Series Switches" section).

The switch supports up to 20 trap receivers through the RMON2 trap destination table. Configure the RMON2 trap destination table from the NMS.

Configuring SNMP from the CLI

To configure SNMP from the command-line interface (CLI), perform this task in privileged mode:

Task Command

Step 1 Define the SNMP community strings for each access type.

set snmp community read-only community_string
set snmp community read-write community_string
set snmp community read-write-all community_string

Step 2 Assign a trap receiver and community. You can specify up to ten trap receivers.

set snmp trap rcvr_address rcvr_community

Step 3 Specify the SNMP traps to send to the trap receiver.

set snmp trap enable [all | module | chassis | bridge | repeater | auth | vtp | ippermit | vmps | config | entity | stpx]

Step 4 Verify the SNMP configuration.

show snmp

Task	Command
Step 1 Define the SNMP community strings for each access type.	set snmp community read-only community_string set snmp community read-write community_string set snmp community read-write-all community_string
Step 2 Assign a trap receiver and community. You can specify up to ten trap receivers.	set snmp trap rcvr_address rcvr_community
Step 3 Specify the SNMP traps to send to the trap receiver.	set snmp trap enable [all \| module \| chassis \| bridge \| repeater \| auth \| vtp \| ippermit \| vmps \| config \| entity \| stpx]
Step 4 Verify the SNMP configuration.	show snmp

This example shows how to define community strings, assign a trap receiver, and specify which traps to send to the trap receiver:

Console> (enable) set snmp community read-only Everyone

SNMP read-only community string set to 'Everyone'.
Console> (enable) set snmp community read-write Administrators

SNMP read-write community string set to 'Administrators'.
Console> (enable) set snmp community read-write-all Root

SNMP read-write-all community string set to 'Root'.
Console> (enable) set snmp trap 172.16.10.10 read-write

SNMP trap receiver added.
Console> (enable) set snmp trap 172.16.10.20 read-write-all

SNMP trap receiver added.
Console> (enable) set snmp trap enable all

All SNMP traps enabled.
Console> (enable) show snmp

RMON:                       Disabled
Extended Rmon:              Extended RMON module is not present
Traps Enabled: 
Port,Module,Chassis,Bridge,Repeater,Vtp,Auth,ippermit,Vmps,config,entity,stpx
Port Traps Enabled: 1/1-2,4/1-48,5/1
Community-Access     Community-String    
----------------     --------------------
read-only            Everyone
read-write           Administrators
read-write-all       Root
Trap-Rec-Address                           Trap-Rec-Community
----------------------------------------   --------------------
172.16.10.10                               read-write
172.16.10.20                               read-write-all
Console> (enable)

Note To disable access for an SNMP community, set the community string for that community to the null string (do not enter a value for the community string).

Using CWSI and CRM with Catalyst 5000 Series Switches

CiscoWorks for Switched Internetworks (CWSI) and Cisco Resource Manager (CRM) are network management products that allow you to deploy, configure, monitor, manage, and troubleshoot a switched internetwork.

The following sections describe these network management applications:

CWSI

CWSI is a suite of network management applications that allows you to configure, monitor, and manage a switched internetwork. CWSI includes the following applications:

Campus Map---Provides a map of the physical devices and links in your discovered network. For more information, see the CWSI Getting Started Guide publication.
VlanDirector---Enables you to display, configure, modify, and manage virtual LANs (VLANs) in your network. For more information, see the CWSI Using VlanDirector publication.
UserTracking---Simplifies moves within dynamic VLANs and tracks end station Media Access Control (MAC) addresses. For more information, see the CWSI UserTracking for End-User Nodes publication.
CiscoView---Displays a graphical representation of a device and allows you to configure and monitor device chassis, port, and interface information. For more information, see the CWSI Using CiscoView with Catalyst and LightStream Switches publication.
TrafficDirector---Provides RMON, protocol analysis, application usage monitoring, traffic analysis, and troubleshooting of network performance problems. For more information, see the CWSI Using TrafficDirector publication.
AtmDirector---Discovers ATM switches, physical links, and permanent and switched virtual connections. Provides performance monitoring of ATM switches and links within the ATM network. Displays ATM VLANs and Private Network-to-Network Interface (PNNI) components and their status in the network. For more information, see the CWSI Using AtmDirector publication.

Cisco Resource Manager

Cisco Resource Manager (CRM) provides an enterprise solution to network management. This suite of web-based network management tools enables administrators to collect the monitoring, fault, and availability information needed to track devices that are critical to the network. CRM also provides the administration tools needed to rapidly and reliably deploy and upgrade Cisco devices.

CRM includes the following functionality:

Device Inventory---You can add, delete, change, and list devices in your network inventory. You can also create, modify, and browse device views.
Device Availability---You can monitor the reachability and response time of user-selected devices on the network.
Syslog Analysis---You can troubleshoot and track device problems, and view summaries of real-time reports on events that are being logged to syslog on behalf of a router.
System Administration---You can review package options before installing or deinstalling task sets; collect server information; check log file status; back up, move, and restore data.
Software Management---You can schedule, download, and monitor software image updates for Cisco devices on your network.
Configuration Management---You can search, update, and relocate the configuration archive.
Troubleshooting---You can start, stop, and check the status of processes running on the back-end server. You can also understand and solve problems using error messages.
Tools---You can access CCO tools; link to Cisco's Customer Service department, check device connections to the CRM server.

For additional information and assistance using CRM, see the Learning to Use Cisco Resource Manager publication.

Using RMON

These sections describe how to use Remote Monitoring (RMON) on the Catalyst 5000 series switches:

Understanding How RMON Works

RMON is an Internet Engineering Task Force (IETF) standard monitoring specification that allows various network agents and console systems to exchange network monitoring data. The Catalyst 5000 series supervisor engine software provides embedded support these components of the RMON specification:

The following RMON groups defined in RFC 1757:
- Statistics (RMON group 1) for Ethernet, Fast Ethernet, Fast EtherChannel, and Gigabit Ethernet switch ports
- History (RMON group 2) for Ethernet, Fast Ethernet, Fast EtherChannel, and Gigabit Ethernet switch ports
- Alarm (RMON group 3)
- Event (RMON group 4)
The RMON group defined in RFC 1513: Token Ring Statistics and History (RMON group 10)
The following RMON2 group defined in RFC 2021: ProbeConfig (RMON2 group 19)

The embedded RMON agent allows the Catalyst 5000 series switch to monitor network traffic from all ports simultaneously at the data-link layer of the OSI model without requiring a dedicated monitoring probe or network analyzer.

Note More RMON capabilities are provided through a Cisco SwitchProbe device (see the SwitchProbe documentation).

Enabling RMON

Note RMON is disabled by default.

To enable RMON, perform this task in privileged mode:

Task Command

Step 1 Enable RMON on the switch.

set snmp rmon enable

Step 2 Verify that RMON is enabled.

show snmp

Task	Command
Step 1 Enable RMON on the switch.	set snmp rmon enable
Step 2 Verify that RMON is enabled.	show snmp

This example shows how to enable RMON on the switch and how to verify that RMON is enabled:

Console> (enable) set snmp rmon enable

SNMP RMON support enabled.
Console> (enable) show snmp

RMON:                       Enabled
Extended Rmon:              Extended RMON module is not present
Traps Enabled: 
Port,Module,Chassis,Bridge,Repeater,Vtp,Auth,ippermit,Vmps,config,entity,stpx
Port Traps Enabled: 1/1-2,4/1-48,5/1
Community-Access     Community-String    
----------------     --------------------
read-only            Everyone
read-write           Administrators
read-write-all       Root
Trap-Rec-Address                           Trap-Rec-Community
----------------------------------------   --------------------
172.16.10.10                               read-write
172.16.10.20                               read-write-all
Console> (enable)

Viewing RMON Data

Access to RMON data is available only on an NMS that supports RFC 1757 and RFC 1513 (see the "Using CWSI and CRM with Catalyst 5000 Series Switches" section). You cannot access RMON data via the Catalyst 5000 series switch CLI; however, CLI show commands provide similar information (refer to the Catalyst 5000 Series Command Reference publication).

Using SPAN

These sections describe how to use the Switched Port Analyzer (SPAN) on the Catalyst 5000 series switches:

Understanding How SPAN Works

SPAN selects network traffic for analysis by a SwitchProbe device or other RMON probe. SPAN mirrors traffic from one or more source ports (Ethernet, Fast Ethernet, Token Ring, or Fiber Distributed Data Interface [FDDI]) on the same VLAN to a destination port for analysis (see Figure 15-1).

Figure 15-1: Example of SPAN Configuration on the Catalyst 5000 Series Switch

In the figure, all traffic on Ethernet port 5 (the source port) is mirrored to Ethernet port 10. A network analyzer on Ethernet port 10 receives all network traffic from Ethernet port 5 without being physically attached to it.

SPAN Configuration Guidelines

Follow these guidelines when configuring SPAN on the Catalyst 5000 series switches:

If the SPAN destination port is a Token Ring port, then the source port or ports must be Token Ring ports.
If the SPAN destination port is a Token Ring port, then the source VLAN must be a Token Ring Concentrator Relay Function (TrCRF).
You cannot disable the reception of incoming packets on the destination SPAN port (using the inpkts enable keywords) on Token Ring SPAN destination ports.
On the Catalyst 5000 series Gigabit EtherChannel switching module (WS-X5410), both the source and destination SPAN ports must be on the same module.
When monitoring a VLAN on the Catalyst 5000 series Gigabit EtherChannel switching module (WS-X5410), you must monitor both transmit and receive traffic (both). You cannot monitor only transmit (tx) or only receive (rx) traffic.
Any traffic between two network nodes on the same network segment attached to a switch port configured as a SPAN source port is not mirrored to the SPAN destination port; only traffic that is switched is mirrored to the SPAN destination port.

Configuring SPAN from the NMS

To configure SPAN from the NMS, refer to the NMS documentation (see the "Using CWSI and CRM with Catalyst 5000 Series Switches" section).

Configuring SPAN from the CLI

Specify the source ports, the destination port, the direction of the traffic through the source ports that you want to mirror to the destination port, and whether or not the destination port can receive packets.

To configure a SPAN port on the Catalyst 5000 series switch, perform this task in privileged mode:

Task Command

Step 1 Configure SPAN source and destination ports.

set span {src_mod/src_ports | src_vlan} dest_mod/dest_port [inpkts {enable | disable}] [rx | tx | both]

Step 2 Verify the SPAN configuration.

show span

Task	Command
Step 1 Configure SPAN source and destination ports.	set span {src_mod/src_ports \| src_vlan} dest_mod/dest_port [inpkts {enable \| disable}] [rx \| tx \| both]
Step 2 Verify the SPAN configuration.	show span

Note With incoming packets enabled (keywords inpkts enable), the SPAN destination port receives traffic from the destination port and switches the traffic onto the VLAN of the source SPAN port; however, the SPAN destination port does not participate in spanning tree. Therefore, take care to avoid creating loops with the SPAN destination port.

This example shows how to configure SPAN so that both transmit and receive traffic from port 1/1 (the SPAN source) is mirrored on port 2/1 (the SPAN destination):

Console> (enable) set span 1/1 2/1

Enabled monitoring of Port 1/1 transmit/receive traffic by Port 2/1
Console> (enable) show span

Status          : enabled
Admin Source    : Port 1/1
Oper Source     : Port 1/1
Destination     : Port 2/1
Direction       : transmit/receive
Incoming Packets: disabled
Console> (enable)

This example shows how to set VLAN 522 as the SPAN source and port 2/1 as the SPAN destination:

Console> (enable) set span 522 2/1

Enabled monitoring of VLAN 522 transmit/receive traffic by Port 2/1
Console> (enable) show span

Status          : enabled
Admin Source    : VLAN 522
Oper Source     : Port 3/1-2
Destination     : Port 2/1
Direction       : transmit/receive
Incoming Packets: disabled
Console> (enable)

This example shows how to set VLAN 522 as the SPAN source and port 3/12 as the SPAN destination. Only transmit traffic is monitored. Normal incoming packets on the SPAN destination port are allowed.

Console> (enable) set span 522 2/12 tx inpkts enable

SPAN destination port incoming packets enabled.
Enabled monitoring of VLAN 522 transmit traffic by Port 2/12
Console> (enable) show span

Status          : enabled
Admin Source    : VLAN 522
Oper Source     : Port 2/1-2
Destination     : Port 2/12
Direction       : transmit
Incoming Packets: enabled
Console> (enable)

To disable SPAN, perform this task in privileged mode:

Task Command

Disable SPAN on the switch.

set span disable

Task	Command
Disable SPAN on the switch.	set span disable

This example shows how to disable SPAN on the switch:

Console> (enable) set span disable

Disabled monitoring of VLAN 522 transmit traffic by Port 2/1
Console> (enable)

Using Cisco Discovery Protocol

These sections describe how to use the Cisco Discovery Protocol (CDP) on the Catalyst 5000 series switches:

Understanding How CDP Works

CDP is a media- and protocol-independent protocol that runs on all Cisco-manufactured equipment including routers, bridges, access and communication servers, and switches. Using CDP, you can view information about all the Cisco devices directly attached to the Catalyst 5000 series switch.

In addition, network management applications can retrieve the device type and SNMP-agent address of neighboring Cisco devices. This enables applications to send SNMP queries to neighboring devices. CDP allows network management applications to discover Cisco devices that are neighbors of already known devices, in particular, neighbors running lower-layer, transparent protocols.

CDP runs on all media that support Subnetwork Access Protocol (SNAP), including LAN and Frame Relay. CDP runs over the data link layer only.

Cisco devices never forward CDP packets. When new CDP information is received, Cisco devices discard old information.

Configuring CDP

To configure CDP, perform this task in privileged mode:

Task Command

Step 1 Enable CDP on the desired ports. Use the all keyword to enable CDP on all ports.

set cdp enable {mod_num/port_num | all}

Step 2 (Optional) Set the message interval for CDP. The allowed range is 5-900 seconds. The default is 60 seconds.

set cdp interval {mod_num/port_num | all} interval

Step 3 Verify the CDP configuration.

show cdp port [mod_num[/port_num]]

Step 4 View information about CDP neighbors.

show cdp neighbors [mod_num[/port_num]] [detail]

Task	Command
Step 1 Enable CDP on the desired ports. Use the all keyword to enable CDP on all ports.	set cdp enable {mod_num/port_num \| all}
Step 2 (Optional) Set the message interval for CDP. The allowed range is 5-900 seconds. The default is 60 seconds.	set cdp interval {mod_num/port_num \| all} interval
Step 3 Verify the CDP configuration.	show cdp port [mod_num[/port_num]]
Step 4 View information about CDP neighbors.	show cdp neighbors [mod_num[/port_num]] [detail]

This example shows how to configure CDP on all ports and verify the configuration:

Console> (enable) set cdp enable all

CDP enabled for all ports.
Console> (enable) set cdp interval all 100

CDP message interval set to 100 seconds for all ports.
Console> (enable) show cdp port

Port      CDP Status  Message-Interval
--------  ----------  ----------------
 1/1      enabled     100     
 1/2      enabled     100     
 5/1      enabled     100     
Console> (enable) show cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater
Port     Device-ID               Port-ID           Platform           Capability
-------- ----------------------- ----------------- ------------------ ----------
 1/1     002267633               3/3               WS-C5000            T S 
Console> (enable) show cdp neighbors detail

Device-ID: 002267633
Device Addresses:
  IP Address: 172.20.52.2
Holdtime: 122 sec
Capabilities: TRANSPARENT_BRIDGE SWITCH 
Version: 
  WS-C5000 Software, Version McpSW: 3.2(1) NmpSW: 3.2(1b)
  Copyright (c) 1995-1998 by Cisco Systems
Platform: WS-C5000
Port-ID (Port on Device): 3/3
Port (Our Port): 1/1     
Console> (enable)

Using System Message Logging

These sections describe how to use system message logging on the Catalyst 5000 series switches:

Understanding How System Message Logging Works

The system message logging software on the Catalyst 5000 series switches can save messages in a log file or direct the messages to other devices. The system message logging facility has these features:

Provides you with logging information for monitoring and troubleshooting
Allows you to select the types of logging information captured
Allows you to select the destination of captured logging information

By default, the Catalyst 5000 series switch logs normal but significant system messages to its internal buffer and sends these messages to the system console. You can specify which system messages should be saved based on the type of facility (see Table 15-2) and the severity level (see Table 15-3). Messages are time-stamped to enhance real-time debugging and management.

You can access logged system messages using the switch CLI or by saving them to a properly-configured UNIX server. The switch software saves syslog messages in an internal buffer that can store up to 1024 messages. Thus, you can monitor system messages remotely by accessing the switch via Telnet or via the console port, or by viewing the logs on a UNIX server.

Note When the Catalyst 5000 series switch first initializes, the network is not connected until the initialization completes. Therefore, messages redirected to a UNIX syslog server are delayed up to 90 seconds.

Table 15-2 describes the facility types supported by the system message logs.

Table 15-2: System Message Log Facilities
Facility Name Definition

cdp

Cisco Discovery Protocol

dtp

Dynamic Trunking Protocol

drip

Dual Ring Protocol

dvlan

Dynamic VLAN

earl

Enhanced Address Recognition Logic

fddi

Fiber Distributed Data Interface

filesys

Flash file system

ip

IP permit list

kernel

Kernel

mgmt

Switch TopN reports

mcast

Multicast (CGMP/IGMP)

mls

Multilayer Switching

pagp

Port Aggregation Protocol

protfilt

Protocol Filtering

pruning

VLAN Trunking Protocol pruning

snmp

Simple Network Management Protocol

spantree

Spanning-Tree Protocol

sys

System

tac

TACACS+

tcp

Transmission Control Protocol

telnet

Telnet protocol

tftp

Trivial File Transfer Protocol

vmps

VLAN Membership Policy Server

vtp

VLAN Trunking Protocol

security

Security

**Table 15-2: System Message Log Facilities**
Facility Name	Definition
cdp	Cisco Discovery Protocol
dtp	Dynamic Trunking Protocol
drip	Dual Ring Protocol
dvlan	Dynamic VLAN
earl	Enhanced Address Recognition Logic
fddi	Fiber Distributed Data Interface
filesys	Flash file system
ip	IP permit list
kernel	Kernel
mgmt	Switch TopN reports
mcast	Multicast (CGMP/IGMP)
mls	Multilayer Switching
pagp	Port Aggregation Protocol
protfilt	Protocol Filtering
pruning	VLAN Trunking Protocol pruning
snmp	Simple Network Management Protocol
spantree	Spanning-Tree Protocol
sys	System
tac	TACACS+
tcp	Transmission Control Protocol
telnet	Telnet protocol
tftp	Trivial File Transfer Protocol
vmps	VLAN Membership Policy Server
vtp	VLAN Trunking Protocol
security	Security

Table 15-3 describes the severity levels supported by the system message logs.

Severity Level	Keyword	Description
0	emergencies	System unusable
1	alerts	Immediate action required
2	critical	Critical condition
3	errors	Error conditions
4	warnings	Warning conditions
5	notifications	Normal but significant condition
6	informational	Informational messages
7	debugging	Debugging messages

Table 15-3: System Message Log Severity Level Definitions

Severity Level Keyword Description

0

emergencies

System unusable

1

alerts

Immediate action required

2

critical

Critical condition

3

errors

Error conditions

4

warnings

Warning conditions

5

notifications

Normal but significant condition

6

informational

Informational messages

7

debugging

Debugging messages

System Log Message Format

System log messages begin with a percent sign (%) and can contain up to 80 characters. Messages are displayed in the following format:

%TIMESTAMP: FACILITY-SEVERITY: Message-text;

Table 15-4 defines the four elements of syslog messages:

Element	Description
TIMESTAMP	Current date and time in the following format: mm/dd/yy,hh:mm:ss.
FACILITY	Two or more uppercase letters that indicate the facility to which the message refers (for example, SNMP, SYS, etc.).
SEVERITY	Single-digit code from 0 to 7 that indicates the severity of the message.
Message-text	Text string containing detailed information about the event being reported.

Table 15-4:

Element Description

TIMESTAMP

Current date and time in the following format: mm/dd/yy,hh:mm:ss.

FACILITY

Two or more uppercase letters that indicate the facility to which the message refers (for example, SNMP, SYS, etc.).

SEVERITY

Single-digit code from 0 to 7 that indicates the severity of the message.

Message-text

Text string containing detailed information about the event being reported.

System Log Message Elements

These examples show typical Catalyst 5000 series switch system messages:

8/15/1998,13:52:46:SYS-5:Module 1 is online
8/15/1998,13:52:52:SYS-5:Module 5 is online
8/15/1998,13:52:54:SYS-5:Module 3 failed due to CBL0, CBL1, or CBL2 Error
8/15/1998,13:52:54:SYS-5:Module 3 failed configuration

Default System Message Logging Configuration

Table 15-5 describes the default system message logging configuration.

Configuration Parameter	Default Setting
System message logging to the console	Enabled
syslog server	None configured
System message logging to Telnet sessions	Enabled
Facility/severity level for system messages	dtp/5 sys/5 all other facilities/2

Table 15-5: Default System Message Logging Configuration

Configuration Parameter Default Setting

System message logging to the console

Enabled

syslog server

None configured

System message logging to Telnet sessions

Enabled

Facility/severity level for system messages

dtp/5
sys/5
all other facilities/2

Configuring System Message Logging

To change the default system message logging facility and severity settings, perform one of these tasks in privileged mode:

Task Command

Set the default facility and severity level for system messages.

set logging level facility severity

Disable system message logging to the console.

set logging console disable

Task	Command
Set the default facility and severity level for system messages.	set logging level facility severity
Disable system message logging to the console.	set logging console disable

Configuring the Syslog Daemon on a UNIX Syslog Server

Before you can send system log messages to a UNIX syslog server, you must configure the syslog daemon on the UNIX server. Log in as root, and perform these steps:

Step 1 Add a line such as the following to the file /etc/syslog.conf:

user.debug /var/log/myfile.log

Note

user.debug

/var/log/

The Catalyst 5000 series switch sends messages according to specified facility types and severity levels. The user keyword specifies the UNIX logging facility used. The messages from the Catalyst 5000 series switch are generated by user processes. The debug keyword specifies the severity level of the condition being logged. You can set UNIX systems to receive all messages from the Catalyst 5000 series switch.

Step 2 Create the log file by entering these commands at the UNIX shell prompt:

$ touch /var/log/myfile.log

$ chmod 666 /var/log/myfile.log

Step 3 Make sure the syslog daemon reads the new changes by entering this command:

$ kill -HUP \Qcat /etc/syslog.pid

Configuring Syslog Servers

Before you can send system log messages to a UNIX syslog server, you must configure the syslog daemon on the UNIX server.

To configure the switch to log messages to a syslog server, perform these steps in privileged mode:

Task Command

Step 1 Add a syslog server to the configuration.¹

set logging server ip_addr

Step 2 Enable system message logging to configured syslog servers.

set logging server enable

Step 3 Set the facility and severity level for syslog server messages.

set logging level facility severity default

¹You can configure a maximum of three syslog servers at any time.

Task	Command
Step 1 Add a syslog server to the configuration.¹	set logging server ip_addr
Step 2 Enable system message logging to configured syslog servers.	set logging server enable
Step 3 Set the facility and severity level for syslog server messages.	set logging level facility severity default

To delete a syslog server from the configuration, enter the clear logging server command as follows:

Console> (enable) clear logging server ip_addr

To disable system message logging to configured syslog server, enter the set logging server command as follows:

Console> (enable) set logging server disable

Configuring Telnet Login Sessions

By default, Telnet login sessions to the Catalyst 5000 series switch are enabled and receive system messages based on the default facility and severity values.

To configure the logging settings for Telnet sessions, perform one of these tasks in privileged mode:

Task Command

Change the facility and severity values for Telnet login sessions.

set logging level facility severity

Disable system message logging to the current Telnet login session.

set logging session disable

or

set logging console disable

Reenable system message logging to the current Telnet login session.

set logging session enable

or

set logging console enable

Task	Command
Change the facility and severity values for Telnet login sessions.	set logging level facility severity
Disable system message logging to the current Telnet login session.	set logging session disable or set logging console disable
Reenable system message logging to the current Telnet login session.	set logging session enable or set logging console enable

Displaying System Messages

To display the current configuration for system messages, perform this task in privileged mode:

Task Command

Display the current system message log configuration.

show logging

Task	Command
Display the current system message log configuration.	show logging

To display the first N system messages in the internal buffer of the Catalyst 5000 series switch, perform this task in privileged mode:

Task Command

Display the first N messages in the buffer.

show logging buffer N

Task	Command
Display the first N messages in the buffer.	show logging buffer N

To display the last N system messages in the internal buffer of the Catalyst 5000 series switch, perform this task in privileged mode:

Task Command

Display the last N messages in the buffer.

show logging buffer -N

Task	Command
Display the last N messages in the buffer.	show logging buffer -N

To verify the system message log configuration, enter the show logging command. If you are verifying the system message log configuration for the console and the syslog server is disabled, the first two lines of output look as follows:

Console> (enable) show logging

Logging console:                      enabled

Logging server:                        disabled

If you are verifying the system message log configuration for a Telnet login session, an additional line showing the current logging session is displayed as follows:

Console> (enable) show logging

Logging console:                        enabled
Logging server:                          disabled
Current Logging Session:       enabled

System Message Logging Examples

This section provides examples for entering the system message log commands to perform the following tasks:

To enable system message logging to configured syslog servers, enter this command:

Console> (enable) set logging server enable

System logging messages will be sent to the configured syslog servers.

To add a new syslog server at IP address 171.69.192.205 to the system logging server table, enter this command:

Console> (enable) set logging server 171.69.192.205

171.69.192.205 added to the System logging server table.

To enable system logging messages to the current login session, enter this command:

Console> (enable) set logging session enable

System logging messages will be sent to the current login session.

To change the default facility to all and severity to 1, enter this command:

Console> (enable) set logging level all 1 default

System logging facility <all> set to severity 1(alerts).

To display the new system message log configuration, enter this command and note the values in the Server/Default Severity and Current Session Severity columns:

Console> (enable) show logging

 
Logging console:              enabled
Logging server:               disabled
Current Logging Session:      enabled
 
 
Facility            Server/Default Severity  Current Session Severity
-------------       -----------------------  ------------------------
cdp                 1                        1
mcast               1                        1
dtp                 1                        1
dvlan               1                        1
earl                1                        1
fddi                1                        1
ip                  1                        1
pruning             1                        1
snmp                1                        1
spantree            1                        1
sys                 1                        1
tac                 1                        1
tcp                 1                        1
telnet              1                        1
tftp                1                        1
vtp                 1                        1
vmps                1                        1
kernel              1                        1
filesys             1                        1
drip                1                        1
pagp                1                        1
mgmt                1                        1
mls                 1                        1
protfilt            1                        1
security            1                        1
 
0(emergencies)        1(alerts)             2(critical)
3(errors)             4(warnings)           5(notifications)
6(information)        7(debugging)
Console> (enable)

To set the facility to snmp and the severity level to 3 for the current session, enter this command:

Console> (enable) set logging level snmp 3

System logging facility <snmp> set to severity 3(errors).

To display the new system message log configuration, enter the following command, and note the new value for snmp under the Current Session Severity column (shown by the arrow):

Console> (enable) show logging
 
Logging console:              enabled
Logging server:               disabled
Current Logging Session:      enabled
 
 
Facility            Server/Default Severity  Current Session Severity
-------------       -----------------------  ------------------------
cdp                 1                        1
mcast               1                        1
dtp                 1                        1
dvlan               1                        1
earl                1                        1
fddi                1                        1
ip                  1                        1
pruning             1                        1

snmp                1                        3
spantree            1                        1
sys                 1                        1
tac                 1                        1
tcp                 1                        1
telnet              1                        1
tftp                1                        1
vtp                 1                        1
vmps                1                        1
kernel              1                        1
filesys             1                        1
drip                1                        1
pagp                1                        1
mgmt                1                        1
mls                 1                        1
protfilt            1                        1
security            1                        1
 
 
0(emergencies)        1(alerts)             2(critical)
3(errors)             4(warnings)           5(notifications)
6(information)        7(debugging)
Console> (enable)

To display the first four messages in the internal buffer, enter this command:

Console> (enable) show logging buffer 4

07/30/1998,12:59:24:SYS-5:Module 1 is online
07/30/1998,12:59:32:SYS-5:Module 9 is online
07/30/1998,12:59:35:SYS-5:Module 5 is online
07/30/1998,12:59:49:SYS-5:Module 2 is online
Console> (enable)

To display the last four messages in the internal buffer, enter this command:

Console> (enable) show logging buffer -4

07/30/1998,15:44:19:PAGP-5:Port 1/1 joined bridge port 1/1.
07/30/1998,15:46:52:DTP-5:Port 1/1 has become isl trunk
07/30/1998,15:46:52:PAGP-5:Port 1/1 left bridge port 1/1.
07/30/1998,15:47:03:PAGP-5:Port 1/1 joined bridge port 1/1.
Console> (enable)

Using the Switch TopN Reports Utility

These sections describe how to use Switch TopN Reports utility on the Catalyst 5000 series switches:

How the Switch TopN Reports Utility Works

The Switch TopN Reports utility allows you to collect and analyze data for each physical port on a Catalyst 5000 series switch.

Note The Switch TopN Reports utility cannot be used to generate reports on ATM or RSM ports.

The Switch TopN Reports utility collects the following data for each physical port:

Port utilization (util)
Number of in/out bytes (bytes)
Number of in/out packets (pkts)
Number of in/out broadcast packets (bcst)
Number of in/out multicast packets (mcst)
Number of in errors (in-errors)
Number of buffer-overflow errors (buf-ovflw)

When the Switch TopN Reports utility starts, it gathers data from the appropriate hardware counters and then goes into sleep mode for a user-specified period of time. When the sleep time ends, the utility gathers the current data from the same hardware counters, compares the current data from the earlier data, and stores the difference. The data for each port is sorted using a user-specified metric chosen from the values shown in Table 15-6.

Metric Value	Definition
util	Utilization
bytes	Input/output bytes
pkts	Input/output packets
bcst	Input/output broadcast packets
mcst	Input/output multicast packets
errors	Input errors
overflow	Buffer overflows

Table 15-6: Valid Switch TopN Reports Metric Values

Metric Value Definition

util

Utilization

bytes

Input/output bytes

pkts

Input/output packets

bcst

Input/output broadcast packets

mcst

Input/output multicast packets

errors

Input errors

overflow

Buffer overflows

Running Switch TopN Reports without the Background Option

If you enter the show top command without specifying the background option, processing begins but the system prompt does not reappear on the screen and you cannot enter other commands while the report is being generated.

You can terminate the Switch TopN process before it finishes by pressing Ctrl-C from the same console or Telnet session, or by opening a separate console or Telnet session and entering the clear top [report_num] command. Once the Switch TopN Reports utility finishes processing the data, it displays the output on the screen immediately. The output is not saved.

Running Switch TopN Reports with the Background Option

If you enter the show top command and specify the background option, processing begins and the system prompt reappears immediately. When processing completes, Switch TopN reports do not display immediately on the screen, but are saved for later viewing.

The system notifies you when the Switch TopN reports are complete by sending a syslog message to the screen. Enter the show top report [report_num] command to view the completed Switch TopN reports. The system displays only those reports that are completed. For reports that are not completed, the system displays a short description of the Switch TopN process information.

You can terminate a Switch TopN process invoked with the background option only by entering the clear top [report_num] command. Pressing Ctrl-C does not terminate the process. Completed Switch TopN reports remain available for viewing until you remove them using the clear top {all | report_num} command.

Running and Viewing Switch TopN Reports

To start a Switch TopN Report in the background and view the results, perform this task in privileged mode:

Task Command

Step 1 Start the Switch TopN Reports utility in the background.

show top [N] [metric] [interval interval] [port_type] background

Step 2 View the generated report when it is complete.

show top report [report_num]

Task	Command
Step 1 Start the Switch TopN Reports utility in the background.	show top [N] [metric] [interval interval] [port_type] background
Step 2 View the generated report when it is complete.	show top report [report_num]

Note You must start the Switch TopN Report utility with the background keyword in order to use the show top report command to view the completed report contents. Otherwise, the report is displayed immediately upon completion of the process, and the results are not saved.

If you specify the report_num with the show top report command, the associated Switch TopN report is displayed. Each process is associated with a unique report number.

If you do not specify the report_num variable, all active Switch TopN processes and all available Switch TopN reports for the switch are displayed. All Switch TopN processes (both with and without the background option) are shown in the list.

This example shows how to start the Switch TopN Reports utility with the background option:

Console> (enable) show top 5 pkts background

Console> (enable) 06/16/1998,17:21:08:MGMT-5:TopN report 4 started by Console//.
Console> (enable) 06/16/1998,17:21:39:MGMT-5:TopN report 4 available.
Console> (enable) show top report 4

Start Time:     06/16/1998,17:21:08
End Time:       06/16/1998,17:21:39
PortType:       all
Metric:         pkts (Tx + Rx)
Port  Band- Uti Bytes                Pkts       Bcst       Mcst       Error Over
      width  %  (Tx + Rx)            (Tx + Rx)  (Tx + Rx)  (Tx + Rx)  (Rx)  flow
----- ----- --- -------------------- ---------- ---------- ---------- ----- ----
 1/1    100   0                 7950         81          0         81     0    0
 2/1    100   0                 2244         29          0         23     0    0
 1/2    100   0                 1548         12          0         12     0    0
 2/10   100   0                    0          0          0          0     0    0
 2/9    100   0                    0          0          0          0     0    0
Console> (enable)

To start a Switch TopN Report in the foreground and view the results immediately, perform this task in privileged mode:

Task Command

Start the Switch TopN Reports utility in the foreground.

show top [N] [metric] [interval interval] [port_type]

Task	Command
Start the Switch TopN Reports utility in the foreground.	show top [N] [metric] [interval interval] [port_type]

This example shows how to start the Switch TopN Reports utility in the foreground:

Console> (enable) show top 5 pkts

Start Time:     06/16/1998,17:26:38
End Time:       06/16/1998,17:27:09
PortType:       all
Metric:         pkts (Tx + Rx)
Port  Band- Uti Bytes                Pkts       Bcst       Mcst       Error Over
      width  %  (Tx + Rx)            (Tx + Rx)  (Tx + Rx)  (Tx + Rx)  (Rx)  flow
----- ----- --- -------------------- ---------- ---------- ---------- ----- ----
 2/1    100   0                10838         94          2         26     0    0
 1/1    100   0                 7504         79          0         79     0    0
 1/2    100   0                 2622         21          0         21     0    0
 2/10   100   0                    0          0          0          0     0    0
 2/9    100   0                    0          0          0          0     0    0
Console> (enable)

To display stored and pending Switch TopN reports, perform this task in privileged mode:

Task Command

Display a Switch TopN report. To display all stored and pending reports, do not specify a report_num.

show top report [report_num]

Task	Command
Display a Switch TopN report. To display all stored and pending reports, do not specify a report_num.	show top report [report_num]

This example shows how to display a specific report and how to display all stored and pending reports:

Console> (enable) show top report 5

Start Time:     06/16/1998,17:29:40
End Time:       06/16/1998,17:30:11
PortType:       all
Metric:         overflow
Port  Band- Uti Bytes                Pkts       Bcst       Mcst       Error Over
      width  %  (Tx + Rx)            (Tx + Rx)  (Tx + Rx)  (Tx + Rx)  (Rx)  flow
----- ----- --- -------------------- ---------- ---------- ---------- ----- ----
 1/1    100   0                 7880         83          0         83     0    0
 2/12   100   0                    0          0          0          0     0    0
 2/11   100   0                    0          0          0          0     0    0
 2/10   100   0                    0          0          0          0     0    0
 2/9    100   0                    0          0          0          0     0    0
Console> (enable) show top report

Rpt  Start time          Int N   Metric     Status   Owner (type/machine/user)
---  ------------------- --- --- ---------- -------- -------------------------
  1  06/16/1998,17:05:00 30  20  Util       done     telnet/172.16.52.3/
  2  06/16/1998,17:05:59 30  5   Util       done     telnet/172.16.52.3/
  3  06/16/1998,17:08:06 30  5   Pkts       done     telnet/172.16.52.3/
  4  06/16/1998,17:21:08 30  5   Pkts       done     Console//
  5  06/16/1998,17:29:40 30  5   Overflow   pending  Console//
Console> (enable)

To remove stored Switch TopN reports, perform this task in privileged mode:

Task Command

Remove Switch TopN reports. Use the all keyword to remove all completed Switch TopN reports.

clear top {all | report_num}

Task	Command
Remove Switch TopN reports. Use the all keyword to remove all completed Switch TopN reports.	clear top {all \| report_num}

Note The command clear top all command does not clear pending Switch TopN reports. Only the reports that have completed are cleared.

This example shows how to remove a specific Switch TopN and how to remove all stored reports:

Console> (enable) clear top 4

Console> (enable) 06/16/1998,17:36:45:MGMT-5:TopN report 4 killed by Console//.
Console> (enable) clear top all

06/16/1998,17:36:52:MGMT-5:TopN report 1 killed by Console//.
06/16/1998,17:36:52:MGMT-5:TopN report 2 killed by Console//.
Console> (enable) 06/16/1998,17:36:52:MGMT-5:TopN report 3 killed by Console//.
06/16/1998,17:36:52:MGMT-5:TopN report 5 killed by Console//.
Console> (enable)

Table of Contents

Configuring Network Management