Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

CRYPTO-4-PKT_REPLAY_ERR syslog parsing

Every time ios generates the "CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed" log msg I receive 3 syslog messages, like ios is not concatenating them into 1 msg string before sending.  It's really annoying because I can't filter a null string that also has a null message type on my nms. I tried changing the facility settings and get the same result.  If i use TCL to filter the syslog msg by type "CRYPTO-4-PKT_REPLAY_ERR" it will only filter the 1st syslog message since the types on the other 2 msgs are null. 

I can't find a bug or discussion about this so I am hoping somebody out there might have a solution ... 

DEVICE INFO:

----------------------------------------

c3825-advipservicesk9-mz.124-25b.bin

logging buffered 15000 debugging

logging rate-limit all 3

no logging console

no logging monitor

crypto logging session

logging origin-id hostname

logging facility syslog

logging source-interface GigabitEthernet0/0

logging 11.22.33.44

FROM LOGGING BUFFER:
----------------------------------------

     !
     Dec 14 08:00:37 CST: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success       [user: johndoe] [Source:
1.2.3.4] [localport: 22] at 08:00:37       CST Wed Dec 14 2011
#1>> Dec 14 08:01:41 CST: %CRYPTO-4-PKT_REPLAY_ERR:       decrypt: replay check failed
#2>>     connection id=70, sequence       number=43990
#3>>

    Dec 14 08:10:36 CST: %SEC_LOGIN-5-LOGIN_SUCCESS: Login       Success [user: johndoe] [Source: 1.2.3.4] [localport: 22] at       08:10:36 CST Wed Dec 14 2011
     !

THREE SYSLOG MSG's RECEIVED:

----------------------------------------
     #1

         MSG TYPE:   CRYPTO-4-PKT_REPLAY_ERR
         MSG
STRING: 7015321: routerA: decrypt:       replay check failed
     #2
        MSG TYPE:   null
         MSG STRING: 7015322:
routerA: connection id=70, sequence       number=43990
    #3
        MSG TYPE:   null
         MSG
STRING: 7015323: routerA:       

Everyone's tags (3)
490
Views
0
Helpful
0
Replies
CreatePlease to create content