IP Switching Cisco Express Forwarding Configuration Guide, Cisco IOS Release 15M&T
Customizing the Display of Recorded CEF Events
Downloads: This chapterpdf (PDF - 1.33MB) The complete bookPDF (PDF - 3.82MB) | The complete bookePub (ePub - 726.0KB) | Feedback

Customizing the Display of Recorded CEF Events

Customizing the Display of Recorded CEF Events

This module contains information about and instructions for customizing the display of recorded Cisco Express Forwarding events for Cisco IOS releases prior to 12.2(25)S, 12.2(33)SB, 12.2(33)SRA, 12.2.(33)SXH, and 12.4(20)T.

For information about and instructions for customizing the display of recorded Cisco Express Forwarding events for Cisco IOS Releases 12.2(25)S, 12.2(33)SB, 12.2(33)SRA, 12.2.(33)SXH, 12.4(20)T, and later releases, see Customizing the Display of Cisco IOS Event Trace Messages.

You can customize the Cisco Express Forwarding event log display by specifying the size of the Cisco Express Forwarding event log or by choosing to display events by prefix and mask or by Cisco Express Forwarding Virtual Private Network (VPN) routing/forwarding instance (VRF).

Cisco Express Forwarding is an advanced Layer 3 IP switching technology. It optimizes network performance and scalability for all kinds of networks: those that carry small amounts of traffic and those that carry large amounts of traffic in complex patterns, such as the Internet and networks characterized by intensive web-based applications or interactive sessions.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Prerequisites for the Display of Recorded CEF Events

Cisco Express Forwarding must be running on the networking device before you can customize the display of recorded Cisco Express Forwarding events.

Restrictions for the Display of Recorded CEF Events

If you enable Cisco Express Forwarding and then create an access list that uses the log keyword, the packets that match the access list are not Cisco Express Forwarding switched. They are fast switched. Logging disables Cisco Express Forwarding.

Information About the Display of Recorded CEF Events

For links to information about other Cisco Express Forwarding and distributed Cisco Express Forwarding features that you can configure, go to the Additional References.

Cisco Platform Support for Central CEF and dCEF

Cisco Express Forwarding is enabled by default on most Cisco platforms running Cisco IOS software Release 12.0 or later. When Cisco Express Forwarding is enabled on a router, the Route Processor (RP) performs the express forwarding.

To find out if Cisco Express Forwarding is enabled on your platform, enter the show ip cefcommand. If Cisco Express Forwarding is enabled, you receive output that looks like this:

Router# show ip cef 
Prefix              Next Hop            Interface
[...]
10.2.61.8/24        192.168.100.1       FastEthernet1/0/0
                    192.168.101.1       FastEthernet6/1
[...]

If Cisco Express Forwarding is not enabled on your platform, the output for the show ip cefcommand looks like this:

Router# show ip cef
%CEF not running

Distributed Cisco Express Forwarding is enabled by default on the Catalyst 6500 series switch, the Cisco 7500 series router, and the Cisco 12000 Series Internet Router. When distributed Cisco Express Forwarding is enabled on your platform, the line cards perform the express forwarding.

If Cisco Express Forwarding is not enabled on your platform, use the ip cef command to enable (central) Cisco Express Forwarding or the ip cef distributed command to enable distributed Cisco Express Forwarding.

CEF Event Log Overview

The Cisco Express Forwarding event log collects Cisco Express Forwarding events as they occur, even when debugging is not enabled. This allows the tracing of an event immediately after it occurs. Cisco technical personnel can use the event log to help resolve problems with the Cisco Express Forwarding feature.

When the Cisco Express Forwarding event log has reached its capacity, the oldest event is written over by the newest event. You can use the following commands to change the capacity of the Cisco Express Forwarding event log:

  • The ip cef table event-logcommand allows you to increase or decrease the number of entries that the event log can hold.
  • The clear ip cef event-log command allows you to clear all event log entries.

You can use the following commands to display Cisco Express Forwarding events:

  • The show ip cef eventscommand displays all recorded Cisco Express Forwarding forwarding information base (FIB) and adjacency events.
  • The debug ip cef command and the events keyword record general Cisco Express Forwarding events as they occur.
  • The debug ip cef tablecommand enables the real-time collection of events that affect entries in the Cisco Express Forwarding tables.

How to Customize the Display of Recorded CEF Events

Customizing CEF Event Logging

This section contains information about and instructions for customizing Cisco Express Forwarding event logging.

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    ip cef table event-log [size event-number] [match ip-prefix mask] [vrf vrf-name]

    4.    exit


DETAILED STEPS
     Command or ActionPurpose
    Step 1 enable


    Example:
    Router> enable
     

    Enables privileged EXEC mode.

    • Enter your password if prompted.
     
    Step 2 configure terminal


    Example:
    Router# configure terminal
     

    Enters global configuration mode.

     
    Step 3 ip cef table event-log [size event-number] [match ip-prefix mask] [vrf vrf-name]


    Example:
    Router(config)# ip cef table event-log size 25000
     

    Controls Cisco Express Forwarding table event-log characteristics.

    • The size event-number keyword-argument pair specifies the number of event entries. The range is from 1 to 4294967295.
    • The match keyword logs events that match the specified prefix and mask.
    • The ip-prefix argument is the specified IP prefix to match in dotted decimal format (A.B.C.D).
    • The mask argument is the network mask written as A.B.C.D.
    • The vrf vrf-name keyword-argument pair displays the named Virtual Private Network (VPN) routing/forwarding instance (VRF) Cisco Express Forwarding table.
     
    Step 4 exit


    Example:
    Router(config)# exit 
     

    Exits to privileged EXEC mode.

     

    Displaying CEF Event-Log Information

    Perform the following task to display Cisco Express Forwarding event-log information.

    SUMMARY STEPS

      1.    enable

      2.    clear ip cef event-log

      3.    debug ip cef table

      4.    show ip cef events summary

      5.    show ip cef events within seconds

      6.    exit


    DETAILED STEPS
      Step 1   enable

      Use this command to enable privileged EXEC mode. For example:



      Example:
      Router> enable
      

      Enter your password if prompted.

      Step 2   clear ip cef event-log

      Use this command to clear the Cisco Express Forwarding event-log buffer. For example:

      Router# clear ip cef event-log


      Example:
      
      
              
      Step 3   debug ip cef table

      Use this command to enable the collection of events that affect entries in the Cisco Express Forwarding tables. For example:



      Example:
      Router# debug ip cef table 
      01:25:46:CEF-Table:Event up, 10.1.1.1/32 (rdbs:1, flags:1000000) 
      01:25:46:CEF-IP:Checking dependencies of 0.0.0.0/0 
      01:25:47:CEF-Table:attempting to resolve 10.1.1.1/32 
      01:25:47:CEF-IP:resolved 10.1.1.1/32 via 10.9.104.1 to 10.9.104.1 Ethernet2/0/0 
      01:26:02:CEF-Table:Event up, default, 0.0.0.0/0 (rdbs:1, flags:400001) 
      01:26:02:CEF-IP:Prefix exists - no-op change 
      
      Step 4   show ip cef events summary

      Use this command to display a summary of recorded Cisco Express Forwarding FIB and adjacency events. For example:



      Example:
      Router# show ip cef events summary
      CEF table events summary:
           Storage for 10000 events (320000 bytes), 822/0 events recorded/ignored
           Matching all events, traceback depth 16
           Last event occurred 00:00:06.516 ago.
      
      Step 5   show ip cef events within seconds

      Use this command to display Cisco Express Forwarding events that occurred within (during) a specified number of seconds. For example, within 1 second:



      Example:
      Router# show ip cef events within 1
      CEF table events (storage for 10000 events, 14 events recorded)
      +00:00:00.000:[Default-table] *.*.*.*/*           New FIB table          [OK]
      +00:00:00.000:[Default-table] 10.1.80.194/32      FIB insert in mtrie    [OK]
      +00:00:00.000:[Default-table] 10.1.80.0/32        FIB insert in mtrie    [OK]
      +00:00:00.000:[Default-table] 10.1.80.255/32      FIB insert in mtrie    [OK]
      +00:00:00.004:[Default-table] 10.1.80.0/24        FIB insert in mtrie    [OK]
      +00:00:00.004:[Default-table] 10.1.80.0/24        NBD up                 [OK]
      +00:00:00.004:[Default-table] 239.224.0.0/4       FIB insert in mtrie    [OK]
      +00:00:00.012:[Default-table] 10.1.80.0/24        NBD up                 [Ignr]
      +00:00:00.012:[Default-table] 239.224.0.0/4       FIB remove             [OK]
      +00:00:00.016:[Default-table] 239.224.0.0/4       FIB insert in mtrie    [OK]
      +00:00:05.012:[Default-table] 239.224.0.0/4       FIB remove             [OK]
      +00:00:05.012:[Default-table] 239.224.0.0/4       FIB insert in mtrie    [OK]
      +00:00:28.440:[Default-table] 239.224.0.0/4       FIB remove             [OK]
      +00:00:28.440:[Default-table] 239.224.0.0/4       FIB insert in mtrie    [OK]
      First event occured at 00:00:36.568 (00:04:40.756 ago)
      Last event occured at 00:01:05.008 (00:04:12.316 ago)
      
      Step 6   exit

      Use this command to exit to user EXEC mode. For example:



      Example:
      Router# exit
      Router>

      Configuration Examples for the Display of Recorded CEF Events

      Example Customizing CEF Event Logging

      The following example shows how to enable event logging for Cisco Express Forwarding:

      clear ip cef event-log
      !
      debug ip cef table
      !
      configure terminal
      !
      ip cef table event-log size 25000
      exit
      !

      In this example, the Cisco Express Forwarding event log is configured to hold 25000 entries.

      Additional References

      Related Documents

      Related Topic

      Document Title

      Cisco IOS commands

      Cisco IOS Master Commands List, All Releases

      Cisco Express Forwarding commands

      Cisco IOS IP Switching Command Reference

      Overview of the Cisco Express Forwarding feature

      Cisco Express Forwarding Overview

      Tasks for verifying basic Cisco Express Forwarding and distributed Cisco Express Forwarding operation

      Configuring Basic Cisco Express Forwarding for Improved Performance, Scalability, and Resiliency in Dynamic Networks

      Tasks for enabling or disabling Cisco Express Forwarding or distributed Cisco Express Forwarding

      Enabling or Disabling Cisco Express Forwarding or Distributed Cisco Express Forwarding to Customize Switching and Forwarding for Dynamic Networks

      Tasks for configuring load-balancing schemes for Cisco Express Forwarding

      Configuring a Load-Balancing Scheme for Cisco Express Forwarding Traffic

      Tasks for configuring Cisco Express Forwarding consistency checkers

      Configuring Cisco Express Forwarding Consistency Checkers for Route Processors and Line Cards

      Tasks for configuring epochs for Cisco Express Forwarding tables

      Configuring Epochs to Clear and Rebuild Cisco Express Forwarding and Adjacency Tables

      Tasks for configuring and verifying Cisco Express Forwarding network accounting

      Configuring Cisco Express Forwarding Network Accounting

      Tasks for customizing the display of recorded Cisco Express Forwarding events trace messages for Cisco IOS Releases 12.2(25)S, 12.2(33)SB, 12.2(33)SRA, 12.2.(33)SXH, 12.4(20)T and later releases

      Customizing the Display of Cisco IOS Event Trace Messages

      Causes of common Cisco Express Forwarding-related error messages on platforms running distributed Cisco Express Forwarding switching (Cisco 7500 series routers and Cisco 12000 series Internet routers) and how to troubleshoot them

      Troubleshooting Cisco Express Forwarding-Related Error Messages

      Standards

      Standards

      Title

      No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

      --

      MIBs

      MIBs

      MIBs Link

      No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

      To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

      http:/​/​www.cisco.com/​go/​mibs

      RFCs

      RFCs

      Title

      No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.

      --

      Technical Assistance

      Description

      Link

      The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

      http:/​/​www.cisco.com/​cisco/​web/​support/​index.html

      Feature Information for the Display of Recorded CEF Events

      The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

      Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

      Table 1 Feature Information for Configuring the Display of Recorded Cisco Express Forwarding Events

      Feature Name

      Releases

      Feature Configuration Information

      This table is intentionally left blank because no features were introduced or modified in Cisco IOS Release 12.2(1) or later. This table will be updated when feature information is added to this module.

      --

      --

      Glossary

      adjacency --A relationship formed between selected neighboring routers and end nodes for the purpose of exchanging routing information. Adjacency is based upon the use of a common media segment by the routers and nodes involved.

      Cisco Express Forwarding --A Layer 3 switching technology. Cisco Express Forwarding can also refer to central Cisco Express Forwarding mode, one of two modes of Cisco Express Forwarding operation. Cisco Express Forwarding enables a Route Processor to perform express forwarding. Distributed Cisco Express Forwarding is the other mode of Cisco Express Forwarding operation.

      distributed Cisco Express Forwardin g--A mode of Cisco Express Forwarding operation in which line cards (such as Versatile Interface Processor (VIP) line cards) maintain identical copies of the forwarding information base (FIB) and adjacency tables. The line cards perform the express forwarding between port adapters; this relieves the Route Switch Processor of involvement in the switching operation.

      FIB --forwarding information base. A component of Cisco Express Forwarding that is conceptually similar to a routing table or information base. The router uses the FIB lookup table to make destination-based switching decisions during Cisco Express Forwarding operation. The router maintains a mirror image of the forwarding information in an IP routing table.

      line card --A general term for an interface processor that can be used in various Cisco products. For example, a Versatile Interface Processor (VIP) is a line card for the Cisco 7500 series router.

      prefix --The network address portion of an IP address. A prefix is specified by a network and mask and is generally represented in the format network/mask. The mask indicates which bits are the network bits. For example, 1.0.0.0/16 means that the first 16 bits of the IP address are masked, making them the network bits. The remaining bits are the host bits. In this example, the network number is 10.0.

      VPN --Virtual Private Network. The result of a router configuration that enables IP traffic to use tunneling to travel securely over a public TCP/IP network.

      VRF --A Virtual Private Network (VPN) routing/forwarding instance. A VRF consists of an IP routing table, a derived forwarding table, a set of interfaces that use the forwarding table, and a set of rules and routing protocols that determine what goes into the forwarding table. In general, a VRF includes the routing information that defines a customer VPN site that is attached to a PE router.