Bottom of Log display

Answered Question
Mar 12th, 2009

If the log display 'show log' is long and I need to jump to the bottom of display rather than scrolling down, is that possible ?

I have this problem too.
1 vote
Correct Answer by Giuseppe Larosa about 7 years 8 months ago

Hello Cisco_Lite,

if you use datetime for timestamps you can do something like

sh log | inc Mar 12

or

sh log | begin Mar 12

this allows to go to the last lines of the buffer

note:

in the first days of mounth there are two spaces between mounth (expressed as 3 letters) and the day number

so you need to use

sh log | inc Mar 9

example:

SW-MI-MCN-C-7>sh log | inc Mar 12

Mar 12 02:28:58: %SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port GigabitEthernet0/27 on VLAN0001.

Mar 12 02:28:58: %SPANTREE-2-LOOPGUARD_UNBLOCK: Loop guard unblocking port GigabitEthernet0/27 on VLAN0001.

Mar 12 07:37:25: %SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port GigabitEthernet0/28 on VLAN0001.

Mar 12 07:37:25: %SPANTREE-2-LOOPGUARD_UNBLOCK: Loop guard unblocking port GigabitEthernet0/28 on VLAN0001.

SW-MI-MCN-C-7>

I use this very often.

be aware that this can filter some messages so when you are in doubt use the begin option

Hope to help

Giuseppe

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Giuseppe Larosa Thu, 03/12/2009 - 00:49

Hello Cisco_Lite,

if you use datetime for timestamps you can do something like

sh log | inc Mar 12

or

sh log | begin Mar 12

this allows to go to the last lines of the buffer

note:

in the first days of mounth there are two spaces between mounth (expressed as 3 letters) and the day number

so you need to use

sh log | inc Mar 9

example:

SW-MI-MCN-C-7>sh log | inc Mar 12

Mar 12 02:28:58: %SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port GigabitEthernet0/27 on VLAN0001.

Mar 12 02:28:58: %SPANTREE-2-LOOPGUARD_UNBLOCK: Loop guard unblocking port GigabitEthernet0/27 on VLAN0001.

Mar 12 07:37:25: %SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port GigabitEthernet0/28 on VLAN0001.

Mar 12 07:37:25: %SPANTREE-2-LOOPGUARD_UNBLOCK: Loop guard unblocking port GigabitEthernet0/28 on VLAN0001.

SW-MI-MCN-C-7>

I use this very often.

be aware that this can filter some messages so when you are in doubt use the begin option

Hope to help

Giuseppe

Eric The Red Fri, 05/02/2014 - 12:58

3850#sh log | inc May 2
3850#sh log | inc May  2
May  2 19:10:42.043: %LINK-5-CHANGED: Interface GigabitEthernet1/0/1, changed state to administratively down

 

There really needs to be a better command to go to the bottom of the output.

As seen above, I had to put two spaces between May and 2 for the command to work properly.

I'm hoping for something more Linux-y, Cisco!

like the tail command, which shows the last 10 entries in the file (by default).

 

[Linux-host]# cat /var/log/messages | tail
May  2 15:20:01 Linux-host crond[18082]: (root) CMD (/usr/lib/sa/sa1 1 1)
May  2 15:29:28 Linux-host db daemon[6498]: updater started -1778637296
May  2 15:29:31 Linux-host db daemon[6498]: updater exited -1776017296
May  2 15:29:31 Linux-host db daemon[6498]: update took -4292.35 sec
May  2 15:29:31 Linux-host db daemon[6498]: update is finished, using new DB
May  2 15:30:01 Linux-host crond[23396]: (root) CMD (/usr/lib/sa/sa1 1 1)
May  2 15:39:53 Linux-host sshd[28626]: Address 10.77.8.40 maps to host.domain.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
May  2 15:39:56 Linux-host sshd[28626]: Accepted password for myuser from 10.77.8.40 port 55740 ssh2
May  2 15:39:56 Linux-host sshd[28626]: pam_unix(sshd:session): session opened for user myuser by (uid=0)
May  2 15:40:01 Linux-host crond[28740]: (root) CMD (/usr/lib/sa/sa1 1 1)
[Linux-host]#

 

or you could just run this command:

[Linux-host]# tail /var/log/messages

 

I listed the cat command because it is roughly equivalent

 

Here's what I would like to see as a command option from Cisco:

 

sh log | tail

 

interesting.... I tried the tail command on a 3850 switch and got this output:

 

3850#tail ?
The command you have entered is available in the IOS.sh.
However, the shell is currently disabled. You can enable
it on this terminal by typing
   'term shell'
You can also enable it for all terminals by configuring the
   'shell processing full'
command. There is additional information in the man command.
For more information, enable shell, and then enter:
'man IOS.sh'
 

 

 

aha!  this worked !! (see below)

(even though tail is not listed as an option on the command)

3850#term shell

3850#sh log | ?
  append    Append redirected output to URL (URLs supporting append operation
            only)
  begin     Begin with the line that matches
  count     Count number of lines which match regexp
  exclude   Exclude lines that match
  format    Format the output using the specified spec file
  include   Include lines that match
  redirect  Redirect output to URL
  section   Filter a section of output
  tee       Copy output to URL

3850#sh log | tail
*Mar 24 08:17:32.649: %SYS-6-CLOCKUPDATE: System clock has been updated from 03:17:32 EST Mon Mar 24 2014 to 04:17:32 EDT Mon Mar 24 2014, configured from console by vty0. (3850-2)
Mar 24 15:27:48.976: %SYS-5-CONFIG_I: Configured from console by myuser on vty1 (10.77.8.40)
Mar 24 16:23:40.601: %CRYPTO-6-AUTOGEN: Generated new 768 bit key pair

<output omitted for brevity and security - but there were 10 entries !>
May  2 19:10:57.132: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to down

3850#

 

 

 

Marvin Rhoads Sat, 05/03/2014 - 06:02

On IOS I use "service sequence-numbers" in my configs and then (after the first long log output) I use "show log | b <last sequence number I want to start from>".

I didn't know there was an undocumented "tail" operand. Good find!

In NX-OS, you can use the "last" operand - e.g "show logging last 20"

Actions

This Discussion