Creat span session failed for SPAN sources

Unanswered Question
Nov 21st, 2008
User Badges:

I have newly installed the NAM module in Cat 6500. When I create span session I get an error "Create span session failed for SPAN sources".

Other modules in the chassis are: ACE, FWSM, IDSM.

SNMP is already enabled on the switch.

Please assist.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Joe Clarke Fri, 11/21/2008 - 12:24
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Do you already have the maximum number of span sessions defined? What is the output of "show span" (CatOS) or "show monitor session all" (IOS)?

new_networker Fri, 11/21/2008 - 12:55
User Badges:

I have not defined any span sessions on the switch. The only definition added via NAM is rmon collection on one interface as below

interface GigabitEthernet4/1


switchport access vlan 11

switchport mode access

speed 1000

duplex full

rmon collection stats 6000 owner monitor

spanning-tree portfast

spanning-tree bpduguard enable

The output of "show monitor session all" is

Session 1


Type : Service Module Session

Modules allowed : 1-9

Modules active : 1,7

BPDUs allowed : Yes


Joe Clarke Fri, 11/21/2008 - 13:07
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

You have one session established already. Probably for one of your other modules. How exactly are you defining your span session in the NAM UI?

new_networker Fri, 11/21/2008 - 13:25
User Badges:

Sequence of Steps:

1. Initial setup of NAM with IP

2. Accessed NAM GUI

3. Configured SNMP on the Cat 6500 switch

4. Successfully configured switch information on NAM under Setup / Switch parameters

5. Went to Port Stats (mini-Rmon) and enabled one interface Gi4/1

6. Went to Setup / Data Sources / SPAN

7. Created SPAN for any single interface on 48 port ethernet module and got the error message in subject.

Joe Clarke Fri, 11/21/2008 - 13:31
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

What span session number did you select? You will need to select Monitor Session number 2 from the list of available Monitor Sessions. You cannot use 1 since that is already in use by one of your other service modules.

new_networker Fri, 11/21/2008 - 13:49
User Badges:

Great. I used Monitor Session 2 and it worked.

Could you please tell how to identify where I have defined Monitor Session 1.

Few Queries:

1. How does using different monitor sessions benefit

2. Would including all the 48 ports in the ethernet module into SPAN sessions have any performance impact on the Cat 6500.

Joe Clarke Fri, 11/21/2008 - 14:00
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

If you look at the output of your show monitor session all command, you see that session 1 is already used. The FWSM typically occupies one span session. The 6500 is limited to two local span sessions.

Including all ports on a module in a span will have little impact on the switch, but it could overflow the gigabit interface that NAM uses.

new_networker Sat, 11/22/2008 - 03:17
User Badges:

If all ports are included wouldn't it be 4.8Gbps when used in full capacity and hence cause an overflow for sure.

How about the CPU and memory usage. My main concern is that the Prod Application should be impacted because of my increased monitoring settings. Ideally speaking I would like all the ports to be monitored for any required troubleshooting....don't know where a problem may appear.

Joe Clarke Sat, 11/22/2008 - 09:06
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Yes, if all ports are running at capacity, then packet loss would occur for sure on the NAM. Still, the port monitoring will not impact production traffic flow on the switch.


This Discussion