Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

syslog for interface up/down (flappin g) event

Hi all,

We operate networks in a factory environment. Sometimes we have some poor quality cabling and we can see in the log on the switch that the port is going up/down very often (ie not just because the attached device has been powered on/off).

I know we can have syslog events for interface up/down, but what I woudl like to do is log these events only if we see say "10 up or down events over the period of 5 minutes".

e.g I want a command like this:

"logging event link-status every 10 for 5"

This is kind of like the: "login on-failure log every 3"

Cheers, Simon.

2 ACCEPTED SOLUTIONS

Accepted Solutions
Hall of Fame Super Silver

syslog for interface up/down (flappin g) event

Simon

I wonder if you could get the functionality you want by using an EEM script. EEM can watch for particular syslog messages such as line is down. You might be able to create some logic that would put entries into a table with a time stamp and watch for the table to accumulate 10 entries in 5 minutes.

HTH

Rick

Re: syslog for interface up/down (flappin g) event

Hi Simon,

there is also a build-in error-disable event in IOS called link-flapping:

show errdisable flap-values

ErrDisable Reason    Flaps    Time (sec)
-----------------    ------   ----------
pagp-flap              3       30
dtp-flap               3       30
link-flap              5       10

So here a link-flap event is triggerd when the link flaps 5 times in 10 seconds.

Most (maybe even all?) platforms allow you to change those values: https://supportforums.cisco.com/docs/DOC-4876

When errdisable detect link-flap is enabled and such an event occurs, the interface is shut down and a syslog-message is also send:

%PM-4-ERR_DISABLE: link-flap error detected on Gi4/1, putting Gi4/1 in err-disable state

If you don't like the idea of having to wait for the errdisable recovery-timer to re-activate the interface after such an event, you could perfectly use the syslog message for triggering a more sophisticated EEM applet or -script, like suggested by Rick.

HTH

Rolf

4 REPLIES
Hall of Fame Super Silver

syslog for interface up/down (flappin g) event

Simon

I wonder if you could get the functionality you want by using an EEM script. EEM can watch for particular syslog messages such as line is down. You might be able to create some logic that would put entries into a table with a time stamp and watch for the table to accumulate 10 entries in 5 minutes.

HTH

Rick

Re: syslog for interface up/down (flappin g) event

Hi Simon,

there is also a build-in error-disable event in IOS called link-flapping:

show errdisable flap-values

ErrDisable Reason    Flaps    Time (sec)
-----------------    ------   ----------
pagp-flap              3       30
dtp-flap               3       30
link-flap              5       10

So here a link-flap event is triggerd when the link flaps 5 times in 10 seconds.

Most (maybe even all?) platforms allow you to change those values: https://supportforums.cisco.com/docs/DOC-4876

When errdisable detect link-flap is enabled and such an event occurs, the interface is shut down and a syslog-message is also send:

%PM-4-ERR_DISABLE: link-flap error detected on Gi4/1, putting Gi4/1 in err-disable state

If you don't like the idea of having to wait for the errdisable recovery-timer to re-activate the interface after such an event, you could perfectly use the syslog message for triggering a more sophisticated EEM applet or -script, like suggested by Rick.

HTH

Rolf

New Member

Re: syslog for interface up/down (flappin g) event

Thanks guys for the two helpful replies. I think I will try an EEM script. The err-disable linkflap setting is probably best left as is to do the job it was designed for.

Cheers, Simon.

Re: syslog for interface up/down (flappin g) event

If your hardware supports it, you may find an optimized toolbox in the ESM (Embedded Syslog Manager).

"The Embedded Syslog Manager (ESM) feature provides a programmable framework that allows you to filter, escalate, correlate, route, and customize system logging messages prior to delivery by the Cisco IOS system message logger."

This "message counting example" looks very interesting, maybe you can modifiy it for your needs.

HTH

Rolf

768
Views
0
Helpful
4
Replies