Which side is failing?

beckerola · ‎02-20-2007

Hi

I'm doing a report on a HDLC line that failed somes days ago, and seeing the logs doesn't give me details about which side caused the problem. Is there a way to figure out where the problem started (which side) if you don't have more information about what happened?

Could OSPF messages saying the neighbor is down tell us that the other side is the one that's failing?

%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial6/3, changed state to down

Jan 9 03:20:47: %OSPF-5-ADJCHG: Process 1, Nbr 172.20.2.102 on Serial6/3 from INIT to DOWN, Neighbor Down: Int

Jan 9 03:20:57: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial6/3, changed state to up

Jan 9 03:21:03: %OSPF-5-ADJCHG: Process 1, Nbr 172.20.2.102 on Serial6/3 from LOADING to FULL, Loading Done

Thanks

mheusinger · ‎02-20-2007

Hi,

if you have very precise time in the terminating equipment, you could check the failure detection time from the log.

Also be aware it could be the case that none of the terminating devices caused the issue but the intermediate provider equipment.

If you need further assistance, posting the log entries would be helpful.

Regards, Martin

beckerola · ‎02-20-2007

Thanks for replying.

I edited my first message and posted some OSPF logs. I was thinking that maybe if OSPF is saying that his neighbot is down, it cauld be a sign that the other side is the first that's having problems, regardless of the problem being in the middle or the remote router itself.

There's not much further information left to find the source of the problem and I know it's a difficult issue. My boss is very fond on details which is a head ache in these kind of occasions.

mheusinger · ‎02-20-2007

Hi,

if the interface is down then OSPF can not keep the adjacency. This is the result and not indicating anything regarding either side.

First you should check with the SP providing the line. Line protocol down means an OSI layer2 problem. This can be caused by serveral reasons like too many Bit errors. It can mean neither side is the cause, as f.e. EMI can also cause this. So there can still be many reasons. I would have a look at "show interface" output and check for errors. Just the log message alone does not allow to conclude too much.

Regards, Martin