IOS IP Service Level Syslogging Question

Unanswered Question
Jul 20th, 2010

In order to configure Embedded Event Manager I’m trying to buffer log ICMP Echo reply failure via IP SLA.  Entry 103 also triggers HSRP; this works a treat; however, I cannot buffer log the failed SLA event.  Here’s my config; where have I gone wrong?

Cust_Rtr#sho ver

Cisco IOS Software, 3800 Software (C3845-SPSERVICESK9-M), Version 12.4(3g), RELEASE SOFTWARE (fc2)

show run

!

logging buffered 4096 debugging

!

ip sla monitor logging traps

ip sla monitor 103

type echo protocol ipIcmpEcho 172.16.0.4

tos 192

frequency 10

enhanced-history interval 60 buckets 2

ip sla monitor reaction-configuration 103 react timeout threshold-type immediate action-type trapOnly

ip sla monitor schedule 103 life forever start-time now

!

track 103 rtr 103

interface GigabitEthernet0/1

description Customer Switch

standby 10 track 103 decrement 20

!

snmp-server enable traps syslog

Cust_Rtr#sho log

Syslog logging: enabled (11 messages dropped, 3 messages rate-limited,

                0 flushes, 0 overruns, xml disabled, filtering disabled)

    Console logging: level debugging, 2208379 messages logged, xml disabled,

                     filtering disabled

    Monitor logging: level debugging, 1274 messages logged, xml disabled,

                     filtering disabled

        Logging to: vty450(78)

    Buffer logging: level debugging, 96 messages logged, xml disabled,

                    filtering disabled

    Logging Exception size (4096 bytes)

    Count and timestamp logging messages: disabled

No active filter modules.

    Trap logging: level debugging, 164401 message lines logged

         

Log Buffer (4096 bytes):

Jul 20 21:32:08 bst: %HSRP-6-STATECHANGE: GigabitEthernet0/1 Grp 10 state Standby -> Active

Cust_Rtr#sho ip sla mon stat

Round trip time (RTT) Index 103

Latest RTT: 1 ms

Latest operation start time: 21:54:33.138 bst Tue Jul 20 2010

Latest operation return code: OK

Number of successes: 140

Number of failures: 17

Operation time to live: Forever

Thank you for interest

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Nagaraja Thanthry Tue, 07/20/2010 - 14:19

Hello,

Seems like "snmp-server enable traps syslog" does not generate any syslog messages but it generates SNMP traps. You need to configure "snmp-server enable traps rtr" to send those traps to the SNMP server.

Hope this helps.

Regards,

NT

michael.taylor Wed, 07/21/2010 - 04:48

Hello,

Unfortunately, appending snmp-server enable traps rtr made no difference.  Debugging snmp yielded the following:

Jul 21 11:30:16.912: SNMP: V1 Trap, ent rttMonNotificationsPrefix, addr 80.193.212.65, gentrap 6, spectrap 2
rttMonCtrlAdminTag.101 = 
rttMonHistoryCollectionAddress.101 = 02 00  00 01   
rttMonCtrlOperTimeoutOccurred.101 = 2

confirming that it was indeed working all the time.  Indeed, it continues to work having also removed snmp-server enable traps syslog.

I have now built a EEM applet that's triggered by the corresponding snmp trap to undertake the necessary remedial work to recover from an indirect ethernet failure.

event manager applet IPSLA101Failure
event snmp oid 1.3.6.1.4.1.9.9.42.1.2.9.1.6.101 get-type exact entry-op eq entry-val 1 exit-op eq exit-val 2 poll-interval 10
action 1.0 syslog priority informational msg "Testing-Indirect Ethernet Failure"

This indeed populates the local syslog buffer.

Job done; thanks for reviewing and contributing.

Regards

Actions

This Discussion