Syslog issue

Unanswered Question
May 7th, 2008
User Badges:

Hi Friends,


I need your help regarding syslogs. We noticed that syslogs are not reflecting interfaces down or Admin shut events though logging seems to be properly configured. For example...below is the config on the router


logging buffered 10000 debugging

logging facility local1

logging source-interface Loopback10

logging xxxxx


On one of the interfaces Fa9/47, if i do a unshut and shut again, i only get the below logs on the router


May 7 17:53:35.222 Singapo: %SYS-5-CONFIG_I: Configured from console by xxxxx onvty0 (xxxx.xxxx.xxxx.xxxx)


However it does not reflect the port went down and came up. The device we are using is cisco CISCO7609.


If anyone of you have come across this, please share your suggestions. Thanks!


Best Regards,

Manoj

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
cisco_lad2004 Wed, 05/07/2008 - 03:23
User Badges:
  • Gold, 750 points or more

try adding "snmp trap link-status " under the actual port.


HTH


Sam

Manoj Wadhwa Thu, 05/08/2008 - 04:13
User Badges:

Hi Sam,


We added the below command after which we started receiving the logs in the router buffer.


"Logging event line-status default"


Thanks for your suggestion for snmp.

harmanrms Sat, 05/10/2008 - 04:31
User Badges:

Hi Manoj,

We have 4 Cisco 4507 siwtches and when we use a show logging command there are no logs displayed for port flaps or port downs. Will this command in Cisco 4507 switches help us to display the port flap or down status? Kindly assist.


cisco_lad2004 Sat, 05/10/2008 - 07:03
User Badges:
  • Gold, 750 points or more

yes it would !


http://tools.cisco.com/Support/CLILookup/cltSearchAction.do?Application_ID=CLT&IndexId=IOS&IndexOptionId=123&SearchPhrase=%22*%22&Paging=25&ActionType=getCommandList&Bookmark=True


and if u don't have CCO login, see below.


logging event


To enable notification of interface, subinterface, and Frame Relay data link connection identifier (DLCI) data link status changes, use the logging event command in interface configuration mode. To disable notification, use the no form of this command.


logging event {dlci-status-change | link-status | subif-link-status [ignore-bulk]}


no logging event {dlci-status-change | link-status | subif-link-status [ignore-bulk]}


Pls rate helful posts


HTH


Sam

harmanrms Sat, 05/10/2008 - 07:20
User Badges:

Hi Sam, Thanks 4 d response. I tried to configure for Cisco 4507 switch and I get the following sub commands. The one that you mention in not present.

(config)#logging ?

Hostname or A.B.C.D IP address of the logging host

buffered Set buffered logging parameters

cns-events Set CNS Event logging level

console Set console logging parameters

count Count every log message and timestamp last occurance

exception Limit size of exception flush output

facility Facility parameter for syslog messages

history Configure syslog history table

host Set syslog server IP address and parameters

monitor Set terminal line (monitor) logging parameters

on Enable logging to all supported destinations

rate-limit Set messages per second limit

source-interface Specify interface for source address in logging transactions

trap Set syslog server logging level

Richard Burts Sat, 05/10/2008 - 07:39
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

harman


You are looking in global config and not finding the command. But it is not a global config command. It is an interface command. Go into interface config mode for one of your interfaces and look there. I believe that you will find the command in your interface config mode. And I believe that it will work for you to generate syslog messages when the interface goes up or goes down.


HTH


Rick

harmanrms Sat, 05/10/2008 - 07:56
User Badges:

I got that. Thanks Rick. Thank you all for ur help.

cisco_lad2004 Sat, 05/10/2008 - 07:56
User Badges:
  • Gold, 750 points or more

Hi


TST-POP1-NPE01(config)#logging event link-status default


TST-POP1-NPE01#sh run | inc loggi

logging snmp-authfail

logging buffered 100000 informational

no logging console

logging event link-status default <==============



above is just been tested on 7609 and it is global mode. But perhaps as Rick stated, 4507 would only take this at interface level.


HTH


Sam

cisco_lad2004 Sat, 05/10/2008 - 08:02
User Badges:
  • Gold, 750 points or more

Validated Rick's reply on 4510


interface GigabitEthernet1/6

description ### TST-POP1-AGG01:GI6/3 ###

logging event link-status


Sam


Richard Burts Sat, 05/10/2008 - 08:57
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Sam


Setting it as a default in global config is a nice capability. I had been aware of the logging event link-status as an interface command, and the documentation cited in a previous post identifies it as an interface command. But it looks like sometimes there is a global opportunity. I am not clear whether it is a platform variable or just a version dependent variable. Thanks for making me aware of the global possibility.


HTH


Rick

cisco_lad2004 Sat, 05/10/2008 - 09:05
User Badges:
  • Gold, 750 points or more

Rick


It's a pleasure to be able to repay a very microscopic amount back to the seniors who are making this forum what it is: One of the best learning tools and knowledge sharing places!


Regards


Sam

Actions

This Discussion