|
|
This chapter describes how messages from your Catalyst 5000 series switch are formatted and how you can enable the System Message Log feature to send messages to the switch internal buffer and system console for display (and optionally, to a logging server on another system). Not all messages indicate problems; some messages are purely informational, while others help diagnose problems with communications lines, internal hardware, or the system software.
Messages are listed by the facility (hardware device, protocol, or a module or system software) that produces the messages. Within each facility, messages are listed by the severity level, from highest to lowest. Each message is followed by an explanation and a recommended action. Messages appear only when the system remains operational.
This chapter contains the following sections:
Messages are structured as follows:
facility-severity:descriptionMessages from the System Message Log are structured the same, but include this date/time stamp at the beginning of the message:
mm/dd/yyy:hh/mm/ss:facility-severity:descriptionwhere
mm/dd/yyy:hh/mm/ssis the date and time of the error/event.
Both message types contain this information:
facility code consists of two or more uppercase letters that indicate the reference facility to which the message refers. A facility can be a hardware device, a protocol, or a module of the system software. See Table 1-1.
| Code | Facility |
|---|---|
CDP | Cisco Discovery Protocol |
DTP | Dynamic Trunking Protocol |
DRIP | Dual Ring Protocol |
DVLAN | Dynamic VLAN1 |
EARL | Enhanced Address Recognition Logic |
FDDI | Fiber Distributed Data Interface2 |
FILESYS | Flash File System |
IP | Internet Protocol Permit List |
KERNEL | Kernel |
Log_Error | Logical Link Control |
MGMT | MGMT messages for TopN |
Mcast | Multicast (CGMP/IGMP3) Snooping |
MLS | Multilayer Switching |
PAgP | Port Aggregation Protocol |
Protfilt | Protocol Filtering |
PRUNING | VLAN Trunking Protocol Pruning |
RMON | Remote Monitoring |
SNMP | Simple Network Management Protocol |
SPANTREE | Spanning-Tree Protocol |
SYS | System |
TAC | Terminal Access Controller Access Control System |
TCP | Transmission Control Protocol2 |
TELNET | Standard terminal emulation protocol in the TCP/IP4 protocol stack2 |
TFTP | Trivial File Transfer Protocol2 |
VMPS | VLAN Membership Policy Server |
VTP | VLAN Trunking Protocol |
Security | Security |
| 1VLAN=virtual LAN 2Not covered in this publication 3CGMP/IGMP=Cisco Group Management Protocol/Internet Group Management Protocol 4TCP/IP=Transmission Control Protocol/Internet Protocol |
| Severity Level | Description |
|---|---|
0 - emergency | Unusable system |
1 - alert | Immediate action required |
2 - critical | Critical condition |
3 - error | Error condition |
4 - warning | Warning condition |
5 - notification | Normal but significant condition |
6 - informational | Informational message only |
7 - debugging | Message that appears during debugging only |
description level text string describes the condition. Sometimes it contains detailed information about the event, including terminal port numbers, network addresses, or addresses that correspond to locations in the system memory address space. Because these variable fields can change from message to message, they are represented by short strings in square brackets ([ ]). A decimal number, for example, is represented as [dec]. See Table 1-3.
| Representation | Type of Information |
|---|---|
Decimal | |
Character string | |
[hex] | Hexadecimal integer |
The following is a sample system message; an explanation of the message follows (see Table 1-3):
6/17/1998,18:31:15:SYS-5:Module 5 has been inserted
where
6/17/1998,18:31:15 is the date and time of the error (this appears if set for system log messaging).
SYS is the facility type.
5 is the severity level, indicating that it is a normal but significant condition.
Module 5 has been inserted is the message text.
Catalyst 5000 series switch System Message Log (syslog) software can save system messages in a log file or direct the messages to other devices. You can specify which system messages to save based on the facility type and the severity level of the message. These messages are saved in an internal buffer that can store up to 1024 system log messages in the Catalyst 5000 series switch. You can also save messages on UNIX servers that are configured properly. The syslog software reads the messages from the buffer and sends them to the specified destination.
With syslog, you can access system messages by logging in to the console through Telnet. This allows you to monitor system messages remotely from any workstation that supports the Telnet protocol.
The following is a sample system log error message; an explanation of the message follows:
6/17/1998,18:31:15:SYS-5:Module 5 has been inserted
where
6/17/1998,18:31:15 is the date and time of the error.
SYS is the facility type.
5 is the severity level, indicating that it is a normal but significant condition.
Module 5 has been inserted is the message text.
Each Catalyst 5000 series switch ships with a default configuration. To view the default configuration, enter the show logging command. For an example screen showing the default configuration, see the "Default System Message Log Configuration" section.
When initializing, the Catalyst 5000 series switch displays a severity level 5 (notifications) startup message showing the status of each module and port:
Login sessions:6/24/1998,11:03:11:SYS-5:Module 1 is online.
6/24/1998,11:03:26:SYS-5:Port 1/1 has become trunkAfter switch initialization, a severity level 6 (information) message shows Simple Network Management Protocol (SNMP) socket status information:
Login sessions:6/24/1998,13:59:26:SNMP-6:UDP socket [0] openedUNIX syslog servers:June 24 13:59:31 cat11-lnf.cisco.com :SNMP-6:UDP socket [0] openedThis section describes the configurable options for the System Message Log.
The Catalyst 5000 series switch ships with the default configuration shown in Table 1-4:
| Configuration Parameters | Default Setting |
|---|---|
System message logging to the console | Enabled |
Syslog servers | None configured |
System message logging to Telnet sessions | Enabled |
Facility/severity level for system messages | dtp/5 |
When you first log on to the Catalyst 5000 series switch console, enter the show logging command to display the default configuration. After entering the show logging command, you see this display:
Console <enable> show logging
Logging console: enabled Logging server: disabled Current Logging Session: enabled Facility Server/Default Severity Current Session Severity ------------- ----------------------- ------------------------ cdp 2 2 mcast 2 2 dtp 5 5 dvlan 2 2 earl 2 2 fddi 2 2 ip 2 2 pruning 2 2 snmp 2 2 spantree 2 2 sys 5 5 tac 2 2 tcp 2 2 telnet 2 2 tftp 2 2 vtp 2 2 vmps 2 2 kernel 2 2 filesys 2 2 drip 2 2 pagp 2 2 mgmt 5 5 mls 5 5 protfilt 2 2 0(emergencies) 1(alerts) 2(critical) 3(errors) 4(warnings) 5(notifications) 6(information) 7(debugging) Console>
To change the default facility and severity levels from the default values, perform this task:
| Task | Command |
|---|---|
Set the default facility and severity level for system messages. | set logging level facility severity |
To disable system message logging to the console, enter this command:
Console <enable> set logging console disable
Before system log messages can be sent to a UNIX syslog server, you must configure the syslog daemon on the UNIX server. To configure the syslog daemon on a 4.3 BSD UNIX system, log in as root and perform these steps:
Step 1 Add a line such as the following in the file /etc/syslog.conf:
local7.debug /var/log/myfile.log
The Catalyst 5000 series switch sends messages according to specified facility types and severity levels. The local7 keyword specifies the UNIX logging facility. The messages from the Catalyst 5000 series switch are sent to local7. The debug keyword specifies the severity level of the condition being logged. UNIX systems can be set to receive all messages from the Catalyst 5000 series switch.
Step 2 Create the log file by entering these commands at the UNIX shell prompt:
$ touch /var/log/myfile.log$ chmod 666 /var/log/myfile.log
Step 3 Make the syslog daemon read the new changes by entering this command:
Before system log messages can be sent to a UNIX syslog server, you must configure the syslog daemon on the UNIX server, as described in the section "Console Configuration." To configure the syslog servers, perform these steps:
| Task | Command |
|---|---|
set logging server ip_addr | |
Step 2 Enable system message logging to configured syslog servers. | set logging server enable |
Step 3 Set the facility and severity level for syslog server messages. | set logging level facility severity default |
| 1You can configure a maximum of three syslog servers at any time. |
Console <enable> clear logging server
ip_addr
Console <enable> set logging server disable
By default, Telnet login sessions to the Catalyst 5000 series switch are enabled and receive system messages based on the default facility and severity values. To configure Telnet login sessions, enter these commands:
Console <enable> set logging level facility severity
Console <enable> set logging session disable
Console <enable> set logging session enable
To display the current configuration for system messages, perform this task:
| Task | Command |
|---|---|
Display the current system message log configuration. | show logging |
| Task | Command |
|---|---|
Display the first N messages in the buffer. | show logging buffer N |
| Task | Command |
|---|---|
Display the last N messages in the buffer. | show logging buffer -N |
To verify the System Message Log configuration, enter the show logging command. If you are verifying the System Message Log configuration for the console and the syslog server is disabled, the first two lines of output look as follows:
Console <enable> show logging
Logging console: enabled
Logging server: disabled
Console <enable>show logging
Logging console: enabled
Logging server: disabled
Current Logging Session: enabled
This section provides examples for using the System Message Log commands to perform the following tasks:
Console <enable> set logging server enable
System logging messages will be sent to the configured syslog servers.
Console <enable> set logging server 171.69.192.205
171.69.192.205 added to the System logging server table.
Console <enable> set logging session enable
System logging messages will be sent to the current login session.
Console <enable> set logging level all 2 default
System logging facility <all> set to severity 2(alerts).
Console <enable> set logging level all 1
System logging facility <all> set to severity 1(alerts).
Console <enable> show logging
Logging console: enabled Logging server: disabled Current Logging Session: enabled Facility Server/Default Severity Current Session Severity ------------- ----------------------- ------------------------ cdp 1 1 mcast 1 1 disl 1 1 dvlan 1 1 earl 1 1 fddi 1 1 ip 1 1 pruning 1 1 snmp 1 1 spantree 1 1 sys 1 1 tac 1 1 tcp 1 1 telnet 1 1 tftp 1 1 vtp 1 1 vmps 1 1 kernel 1 1 filesys 1 1 drip 1 1 pagp 1 1 mgmt 1 1 mls 1 1 protfilt 1 1 0(emergencies) 1(alerts) 2(critical) 3(errors) 4(warnings) 5(notifications) 6(information) 7(debugging)
Console <enable> show logging level snmp 3
System logging facility <snmp> set to severity 3 (errors).
To display the new System Message Log configuration, enter this command and note the new value for snmp under the Current Session Severity column:
Console <enable> show logging
Logging console: enabled Logging server: disabled Current Logging Session: enabled Facility Server/Default Severity Current Session Severity ------------- ----------------------- ------------------------ cdp 1 1 mcast 1 1 disl 1 1 dvlan 1 1 earl 1 1 fddi 1 1 ip 1 1 pruning 1 1 snmp 1 3 spantree 1 1 sys 1 1 tac 1 1 tcp 1 1 telnet 1 1 tftp 1 1 vtp 1 1 vmps 1 1 kernel 1 1 filesys 1 1 drip 1 1 pagp 1 1 mgmt 1 1 mls 1 1 protfilt 1 1 0(emergencies) 1(alerts) 2(critical) 3(errors) 4(warnings) 5(notifications) 6(information) 7(debugging) Console>
Console <enable>show logging buffer 4
6/17/1998,13:52:46:SYS-5:Module 1 is online
6/17/1998,13:52:52:SYS-5:Module 5 is online
6/17/1998,13:52:54:SYS-5:Module 3 failed due to CBL0, CBL1, or CBL2 Error
6/17/1998,13:52:54:SYS-5:Module 3 failed configuration
Console <enable>show logging buffer -4
6/17/1998,13:52:54:SYS-5:Module 3 failed configuration
6/17/1998,13:53:04:SYS-5:Module 4 is online
6/17/1998,13:53:31:SNMP-6:Subagent 2 connected
6/17/1998,13:54:45:SNMP-5:Cold Start Trap
|
|