route deleted

Unanswered Question
Nov 2nd, 2008

We have incident that a route has been deleted on one of our router. The next hop was changed. On this situation how can "sho log" helps for the investigation? Is there any other way of tracing and knowing what happens? Thanks

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.5 (2 ratings)
satish_zanjurne Sun, 11/02/2008 - 22:36

Hi Can you elborate more on this ??

1.Route is deleted static or dynamic ?

2.Using show ip route , can you see the route ?

3.Which routes next hop is changed ?

4.Show log will help you in the case , where your routing protocol neighbor releationship is broken, or formed new neighbor releationship

5.Interface went down or come up ?

HTH...rate if helpful..

korbenda11as Mon, 11/03/2008 - 00:03

It is static route. The next hop for the route was changed from the orig. next hop.

tcordier Mon, 11/03/2008 - 01:47

I assume you mean that an entry in the IP routing table (RT) has changed, and not a en entry in your configuration. This means you had an event that made the router change the best next-hop for a certain destination. Such events are best traced with the "debug ip routing" command, which traces and logs all RT events either to your console or the log. This could give you the necessary information about the events that change the entry in your RT. If not, could you describe in mour detail your configuration (especially the routing including any dynamci protocols and static routes)?

HTH, Thomas

korbenda11as Mon, 11/03/2008 - 18:30

Actually the configuration was changed for this static route. How will I know that someone changed/delete/modify the configuration? Is there any information from the log that will say user XXX has changed that specific configuration. thanks

tcordier Tue, 11/04/2008 - 01:25

Yes, such a feature exists, it is called Configuration Change Notification and Logging. See the detailed description at

You enable it with some simple commands:


log config

logging enable

notify syslog

To verify your configuration, use "show archive".

HTH, Thomas


This Discussion