Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

How to find switch crash information from the syslog? wil there be any keywords found in syslog

We have syslog collecting application server, I would like to find a key word that will help me to identify and alert me incase of any switch in the environment get crashed.

Everyone's tags (1)
Hall of Fame Super Gold

You won't find it because

You won't find it because when a switch crash or recovers from a crash, it doesn't have IP connectivity. 


The most effective way is to look at the flash for any crashinfo file(s) or sub-directory.

New Member

Thanks Leo. I have identified

Thanks Leo. I have identified a keyword "%PLATFORM-1-CRASHED" in the stack member switches. 

I'm not sure why this message is not appearing on the master switch.

Do you know ,is there any configuration we have do to see the critical logs of stack members in the master switch???

Hall of Fame Super Gold

Cool!  If you get that

Cool!  If you get that message then you're most likely going to have some crashinfo files.  


Let's say you have a stack of 3 switches.  Run these commands and post the outputs: 


1.  dir flash1: 

2.  dir flash2: 

3.  dir flash3:

New Member

Hi Leo,I have already found

Hi Leo,

I have already found the crash_info file in the flash memory. My aim here is to find the crash information from the syslog and send it to our syslog server to create an alert mechanism , we have only master switch is sending the syslog to the syslog server and in the master switch these error messages are not appearing. hope you got it?

Hall of Fame Super Gold

Again, when a switch crash,

Again, when a switch crash, the LAST THING it will do is attempt to send the crash info to your syslog server.  Unfortunately, the crashinfo will never be sent because it's a file.  So the only place you'll find it is in the appliance itself.  

CreatePlease to create content