IOS IP Service Level Syslogging Question

Unanswered Question
Jul 20th, 2010
User Badges:

In order to configure Embedded Event Manager I’m trying to buffer log ICMP Echo reply failure via IP SLA.  Entry 103 also triggers HSRP; this works a treat; however, I cannot buffer log the failed SLA event.  Here’s my config; where have I gone wrong?

Cust_Rtr#sho ver

Cisco IOS Software, 3800 Software (C3845-SPSERVICESK9-M), Version 12.4(3g), RELEASE SOFTWARE (fc2)

show run


logging buffered 4096 debugging


ip sla monitor logging traps

ip sla monitor 103

type echo protocol ipIcmpEcho

tos 192

frequency 10

enhanced-history interval 60 buckets 2

ip sla monitor reaction-configuration 103 react timeout threshold-type immediate action-type trapOnly

ip sla monitor schedule 103 life forever start-time now


track 103 rtr 103

interface GigabitEthernet0/1

description Customer Switch

standby 10 track 103 decrement 20


snmp-server enable traps syslog

Cust_Rtr#sho log

Syslog logging: enabled (11 messages dropped, 3 messages rate-limited,

                0 flushes, 0 overruns, xml disabled, filtering disabled)

    Console logging: level debugging, 2208379 messages logged, xml disabled,

                     filtering disabled

    Monitor logging: level debugging, 1274 messages logged, xml disabled,

                     filtering disabled

        Logging to: vty450(78)

    Buffer logging: level debugging, 96 messages logged, xml disabled,

                    filtering disabled

    Logging Exception size (4096 bytes)

    Count and timestamp logging messages: disabled

No active filter modules.

    Trap logging: level debugging, 164401 message lines logged


Log Buffer (4096 bytes):

Jul 20 21:32:08 bst: %HSRP-6-STATECHANGE: GigabitEthernet0/1 Grp 10 state Standby -> Active

Cust_Rtr#sho ip sla mon stat

Round trip time (RTT) Index 103

Latest RTT: 1 ms

Latest operation start time: 21:54:33.138 bst Tue Jul 20 2010

Latest operation return code: OK

Number of successes: 140

Number of failures: 17

Operation time to live: Forever

Thank you for interest

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Nagaraja Thanthry Tue, 07/20/2010 - 14:19
User Badges:
  • Cisco Employee,


Seems like "snmp-server enable traps syslog" does not generate any syslog messages but it generates SNMP traps. You need to configure "snmp-server enable traps rtr" to send those traps to the SNMP server.

Hope this helps.



michael.taylor Wed, 07/21/2010 - 04:48
User Badges:


Unfortunately, appending snmp-server enable traps rtr made no difference.  Debugging snmp yielded the following:

Jul 21 11:30:16.912: SNMP: V1 Trap, ent rttMonNotificationsPrefix, addr, gentrap 6, spectrap 2
rttMonCtrlAdminTag.101 = 
rttMonHistoryCollectionAddress.101 = 02 00  00 01   
rttMonCtrlOperTimeoutOccurred.101 = 2

confirming that it was indeed working all the time.  Indeed, it continues to work having also removed snmp-server enable traps syslog.

I have now built a EEM applet that's triggered by the corresponding snmp trap to undertake the necessary remedial work to recover from an indirect ethernet failure.

event manager applet IPSLA101Failure
event snmp oid get-type exact entry-op eq entry-val 1 exit-op eq exit-val 2 poll-interval 10
action 1.0 syslog priority informational msg "Testing-Indirect Ethernet Failure"

This indeed populates the local syslog buffer.

Job done; thanks for reviewing and contributing.



This Discussion