route deleted

korbenda11as · ‎11-02-2008

We have incident that a route has been deleted on one of our router. The next hop was changed. On this situation how can "sho log" helps for the investigation? Is there any other way of tracing and knowing what happens? Thanks

satish_zanjurne · ‎11-02-2008

Hi Can you elborate more on this ??

1.Route is deleted static or dynamic ?

2.Using show ip route , can you see the route ?

3.Which routes next hop is changed ?

4.Show log will help you in the case , where your routing protocol neighbor releationship is broken, or formed new neighbor releationship

5.Interface went down or come up ?

HTH...rate if helpful..

korbenda11as · ‎11-03-2008

It is static route. The next hop for the route was changed from the orig. next hop.

tcordier · ‎11-03-2008

I assume you mean that an entry in the IP routing table (RT) has changed, and not a en entry in your configuration. This means you had an event that made the router change the best next-hop for a certain destination. Such events are best traced with the "debug ip routing" command, which traces and logs all RT events either to your console or the log. This could give you the necessary information about the events that change the entry in your RT. If not, could you describe in mour detail your configuration (especially the routing including any dynamci protocols and static routes)?

HTH, Thomas

korbenda11as · ‎11-03-2008

Actually the configuration was changed for this static route. How will I know that someone changed/delete/modify the configuration? Is there any information from the log that will say user XXX has changed that specific configuration. thanks

tcordier · ‎11-04-2008

Yes, such a feature exists, it is called Configuration Change Notification and Logging. See the detailed description at http://www.cisco.com/en/US/docs/ios/fundamentals/configuration/guide/cf_config-logger_ps6350_TSD_Products_Configuration_Guide_Chapter.html

You enable it with some simple commands: