How to find switch crash information from the syslog? wil there be any keywords found in syslog

[wfranc123]

We have syslog collecting application server, I would like to find a key word that will help me to identify and alert me incase of any switch in the environment get crashed.

[Leo Laohoo]

You won't find it because when a switch crash or recovers from a crash, it doesn't have IP connectivity. 

The most effective way is to look at the flash for any crashinfo file(s) or sub-directory.

[wfranc123]

Thanks Leo. I have identified a keyword "%PLATFORM-1-CRASHED" in the stack member switches. 

I'm not sure why this message is not appearing on the master switch.

Do you know ,is there any configuration we have do to see the critical logs of stack members in the master switch???

[Leo Laohoo]

Cool!  If you get that message then you're most likely going to have some crashinfo files.  

Let's say you have a stack of 3 switches.  Run these commands and post the outputs: 

1.  dir flash1: 

2.  dir flash2: 

3.  dir flash3:

[wfranc123]

Hi Leo,

I have already found the crash_info file in the flash memory. My aim here is to find the crash information from the syslog and send it to our syslog server to create an alert mechanism , we have only master switch is sending the syslog to the syslog server and in the master switch these error messages are not appearing. hope you got it?

[Leo Laohoo]

Again, when a switch crash, the LAST THING it will do is attempt to send the crash info to your syslog server.  Unfortunately, the crashinfo will never be sent because it's a file.  So the only place you'll find it is in the appliance itself.