Meaning of " 14w5d: %C4K_EBM-4-HOSTFLAPPING"

shrivastav · ‎08-17-2007

Hi,

I have got a following entry in my 4000 series switch log.

Can some one explain me What does"14w5d: %C4K_EBM-4-HOSTFLAPPING:" means

It could be an error entry "14w5d" 14 weeks 5 days prior to the time when I accessed log file

OR

it is 14weeks 5 days after the logging was initially configured that the entry is created.

royalblues · ‎08-17-2007

Have a look at this link for common issues with the 4506

http://www.cisco.com/en/US/products/hw/switches/ps4324/products_tech_note09186a008063c36f.shtml

I think you do not have a authoritative time configured on the router; either via NTP or manually.

It is always better to have these commands configured which will help you get the exact time the message was logged

service timestamps debug datetime msec localtime show-timezone

service timestamps log datetime msec localtime show-timezone

HTH

Narayan

Richard Burts · ‎08-17-2007

Raju

In this message 14w5d means that the switch has been up for 14 weeks and 5 days. The default in logging messages is to use system uptime as the timestamp. There is an option which you can configure to use datetime (date and time) as the logging timestamp. This is an especially good option if your switch learns time from an NTP source or if the switch has the built in clock chip that will maintain time over a reboot.

[edit] Narayan I see your answer and agree with most of it. But the issue is not whether the switch has been configured with NTP or not. The default in logging is to use uptime. Even if NTP were configured you will get uptime in the log messages until you set the option to use datetime (which you do illustrate).

HTH

Rick

HTH

Rick

smothuku · ‎08-17-2007

Hi Shri ,

Meaning of the error is as below :

1. %C4K_EBM-4-HOSTFLAPPING: Host [mac-addr] in vlan [dec] is flapping between port [char] and port [char]

The specified host is detected as a source address on multiple ports. Typically, a host is supposed to be learned on only one port. A spanning tree loop is the most common cause of this condition. All traffic from the specified host is temporarily dropped. After 15 seconds, forwarding is reenabled. If the problem persists, the traffic from the problem host continues to be dropped indefinitely.

Recommended Action: Make sure that spanning tree is enabled to prevent spanning tree loops. If you have spanning tree disabled, make sure that you have no spanning tree loops in your network.