Cisco 1841 reboots a couple of times a week - how can I diagnose?

Unanswered Question
Mar 1st, 2008

Hi,

I have a Cisco 1841 router with a DSL module card inserted. The router acts as a VPN via a DSL line to our HQ. I've noticed over the last 2 weeks the VPN line drops and sometimes comes back again. In some cases it doesn't so I get a user at that site to reboot the router. At first I though it was our DSL line, but today I noticed the line went down and came back up for a short while, so I managed to access the router and do a show version and the router said it had been up only 2 minutes, does this mean the router actually rebooted and it's not the DSL line after all?

If so how can I diagnose the problem?

The IOS version is c1814-advsecurityk9-mz.124-17.bin

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
mvsheik123 Sat, 03/01/2008 - 09:10

Hi,

do a 'sh ver' and in the output you should see the cause for the last time reload/reset for the router. Do a search based on that message on cisco site or post 'Sh ver' o/p here, someone will be able to help you.

hth

MS

Richard Burts Sat, 03/01/2008 - 09:22

Andy

If the show version says the router had been up 2 minutes then it certainly does mean that the router reloaded. As suggested by MS the place to start would be with show version. It is usully pretty good about identifying the cause of the last restart. It might be worthwhile to do show flash and see if there are any crashinfo files in flash (crashinfo files are usually created if a software problem caused the router to crash and restart. There might also be helpful information included in show tech from the router.

HTH

Rick

whiteford Sat, 03/01/2008 - 12:21

Hi, the router is down at the moment, but I do remember seeing a crashinfo file when I did a sh flash, what can I do with this?

Richard Burts Sat, 03/01/2008 - 12:31

Andy

If there is a crashinfo file in flash of the router then that pretty much confirms that the router is reloading because of a software problem. If you can correlate the time and date of the crashinfo file with days and times when the link was not available the proof becomes even stronger.

There are several things that you may be able to do with the crashinfo file:

- you can read it directly yourself. There might be information in the crashinfo file that will help you determine the source of the problem.

- you may be able to use the crashinfo file with a tool on the Cisco web site to find information about the problem.

- if you have a support contract on the router you can open a case with Cisco TAC and send the crashinfo file as part of the case.

Obviously Cisco is in the best position to understand the crashinfo file and to determine what the problem is.

If you are not able to do the things that I have suggested, at least the presence of the crashinfo file helps confirm that there is a problem in the version of software that you are running. Perhaps you would want to run a different version of code in the router.

HTH

Rick

whiteford Sun, 03/02/2008 - 09:04

Hi, I know it might sound silly but how do I read the crashinfo file? Do I have to tftp off the router first?

Richard Burts Sun, 03/02/2008 - 09:21

Andy

I frequently TFTP the crashinfo file to my hard drive (assuming that I might want to send it to Cisco) and then read it from there. But it is quite possible to read it on the router. Use the more command to read the crashinfo file (more ).

HTH

Rick

whiteford Sun, 03/02/2008 - 09:31

Thanks, I will try that when I get onsite, I have noticed the firmware it's using is no longer available too - c1814-advsecurityk9-mz.124-17.bin

Richard Burts Sun, 03/02/2008 - 09:57

Andy

Seeing that the version of software has been withdrawn is almost always a good indicator that you should consider changing the version of software that you are running.

HTH

Rick

whiteford Sun, 03/02/2008 - 10:01

It's strange as it's been work great for months, do I go with the latest version? Or is there a stable version somewhere?

Richard Burts Sun, 03/02/2008 - 10:13

Andy

I have been pretty happy with 12.4(15)T3 but you may not want or need to got with T train code. If you want to stay with main line code the more recent is 12.4(18). Or if you want to stay with 12.4(17) there is now a 12.4(17)b which I assume fixes the problems that caused 12.4(17) to be wirhdrawn.

HTH

Rick

whiteford Mon, 03/03/2008 - 03:15

Hi, right I have uploaded the new IOS - 12.4(18) but have yet to reboot, I will do this out of hours tonight. I did a "sh flash:" and see this:

10 235947 Nov 20 2007 10:26:06 +00:00 crashinfo_20071120-102607

It looks like a crash in November though and when I use the "more flash:" command the file is huge, I'm not really sure what I'm looking for.

Is this file to old to be considered, I would of thought a new one would be created, so should I delete it?

Thanks in advance once again.

Richard Burts Mon, 03/03/2008 - 03:36

Andy

The crashinfo file is pretty old. And given the decision to go ahead with a code upgrade I find little value in keeping the file. I would delete it.

HTH

Rick

Actions

This Discussion