IP Switching: Cisco Express Forwarding Configuration Guide, Cisco IOS Release 12.4T
Customizing the Display of Recorded CEF Events
Download this chapter
Customizing the Display of Recorded CEF EventsCustomizing the Display of Recorded CEF Events
Download the complete book
IP Switching: Cisco Express Forwarding Configuration Guide, Cisco IOS Release 12.4TIP Switching: Cisco Express Forwarding Configuration Guide, Cisco IOS Release 12.4T (PDF - 2 MB)
 Feedback

Contents

Customizing the Display of Recorded CEF Events

Last Updated: October 5, 2011

This module contains information about and instructions for customizing the display of recorded Cisco Express Forwarding events for Cisco IOS releases prior to 12.2(25)S, 12.2(33)SB, 12.2(33)SRA, 12.2.(33)SXH, and 12.4(20)T.

For information about and instructions for customizing the display of recorded Cisco Express Forwarding events for Cisco IOS Releases 12.2(25)S, 12.2(33)SB, 12.2(33)SRA, 12.2.(33)SXH, 12.4(20)T, and later releases, see Customizing the Display of Cisco IOS Event Trace Messages.

You can customize the Cisco Express Forwarding event log display by specifying the size of the Cisco Express Forwarding event log or by choosing to display events by prefix and mask or by Cisco Express Forwarding Virtual Private Network (VPN) routing/forwarding instance (VRF).

Cisco Express Forwarding is an advanced Layer 3 IP switching technology. It optimizes network performance and scalability for all kinds of networks: those that carry small amounts of traffic and those that carry large amounts of traffic in complex patterns, such as the Internet and networks characterized by intensive web-based applications or interactive sessions.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Prerequisites for the Display of Recorded CEF Events

Cisco Express Forwarding must be running on the networking device before you can customize the display of recorded Cisco Express Forwarding events.

Restrictions for the Display of Recorded CEF Events

If you enable Cisco Express Forwarding and then create an access list that uses the log keyword, the packets that match the access list are not Cisco Express Forwarding switched. They are fast switched. Logging disables Cisco Express Forwarding.

Information About the Display of Recorded CEF Events

For links to information about other Cisco Express Forwarding and distributed Cisco Express Forwarding features that you can configure, go to the Additional References.

Cisco Platform Support for Central CEF and dCEF

Cisco Express Forwarding is enabled by default on most Cisco platforms running Cisco IOS software Release 12.0 or later. When Cisco Express Forwarding is enabled on a router, the Route Processor (RP) performs the express forwarding.

To find out if Cisco Express Forwarding is enabled on your platform, enter the show ip cefcommand. If Cisco Express Forwarding is enabled, you receive output that looks like this:

Router# show ip cef 
Prefix              Next Hop            Interface
[...]
10.2.61.8/24        192.168.100.1       FastEthernet1/0/0
                    192.168.101.1       FastEthernet6/1
[...]

If Cisco Express Forwarding is not enabled on your platform, the output for the show ip cefcommand looks like this:

Router# show ip cef
%CEF not running

Distributed Cisco Express Forwarding is enabled by default on the Catalyst 6500 series switch, the Cisco 7500 series router, and the Cisco 12000 Series Internet Router. When distributed Cisco Express Forwarding is enabled on your platform, the line cards perform the express forwarding.

If Cisco Express Forwarding is not enabled on your platform, use the ip cef command to enable (central) Cisco Express Forwarding or the ip cef distributed command to enable distributed Cisco Express Forwarding.

CEF Event Log Overview

The Cisco Express Forwarding event log collects Cisco Express Forwarding events as they occur, even when debugging is not enabled. This allows the tracing of an event immediately after it occurs. Cisco technical personnel can use the event log to help resolve problems with the Cisco Express Forwarding feature.

When the Cisco Express Forwarding event log has reached its capacity, the oldest event is written over by the newest event. You can use the following commands to change the capacity of the Cisco Express Forwarding event log:

  • The ip cef table event-logcommand allows you to increase or decrease the number of entries that the event log can hold.
  • The clear ip cef event-log command allows you to clear all event log entries.

You can use the following commands to display Cisco Express Forwarding events:

  • The show ip cef eventscommand displays all recorded Cisco Express Forwarding forwarding information base (FIB) and adjacency events.
  • The debug ip cef command and the events keyword record general Cisco Express Forwarding events as they occur.
  • The debug ip cef tablecommand enables the real-time collection of events that affect entries in the Cisco Express Forwarding tables.

How to Customize the Display of Recorded CEF Events

Customizing CEF Event Logging

This section contains information about and instructions for customizing Cisco Express Forwarding event logging.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip cef table event-log [size event-number] [match ip-prefix mask] [vrf vrf-name]

4.    exit


DETAILED STEPS
 Command or ActionPurpose
Step 1
enable


Example:

Router> enable

 

Enables privileged EXEC mode.

  • Enter your password if prompted.
 
Step 2
configure terminal


Example:

Router# configure terminal

 

Enters global configuration mode.

 
Step 3
ip cef table event-log [size event-number] [match ip-prefix mask] [vrf vrf-name]


Example:

Router(config)# ip cef table event-log size 25000

 

Controls Cisco Express Forwarding table event-log characteristics.

  • The size event-number keyword-argument pair specifies the number of event entries. The range is from 1 to 4294967295.
  • The match keyword logs events that match the specified prefix and mask.
  • The ip-prefix argument is the specified IP prefix to match in dotted decimal format (A.B.C.D).
  • The mask argument is the network mask written as A.B.C.D.
  • The vrf vrf-name keyword-argument pair displays the named Virtual Private Network (VPN) routing/forwarding instance (VRF) Cisco Express Forwarding table.
 
Step 4
exit


Example:

Router(config)# exit

 

Exits to privileged EXEC mode.

 

Displaying CEF Event-Log Information

Perform the following task to display Cisco Express Forwarding event-log information.

SUMMARY STEPS

1.    enable

2.    clear ip cef event-log

3.    debug ip cef table

4.    show ip cef events summary

5.    show ip cef events within seconds

6.    exit


DETAILED STEPS
Step 1   enable

Use this command to enable privileged EXEC mode. For example:



Example: 
Router> enable

Enter your password if prompted.

Step 2   clear ip cef event-log

Use this command to clear the Cisco Express Forwarding event-log buffer. For example:

Router# clear ip cef event-log


Example: 


        
      


      
Step 3  
        
          
            debug
            ip
            cef
            table
          
        

         
          

Use this command to enable the collection of events that affect entries in the Cisco Express Forwarding tables. For example:


        
         

Example:
          
Router# debug ip cef table 
01:25:46:CEF-Table:Event up, 10.1.1.1/32 (rdbs:1, flags:1000000) 
01:25:46:CEF-IP:Checking dependencies of 0.0.0.0/0 
01:25:47:CEF-Table:attempting to resolve 10.1.1.1/32 
01:25:47:CEF-IP:resolved 10.1.1.1/32 via 10.9.104.1 to 10.9.104.1 Ethernet2/0/0 
01:26:02:CEF-Table:Event up, default, 0.0.0.0/0 (rdbs:1, flags:400001) 
01:26:02:CEF-IP:Prefix exists - no-op change 



        
      


      
Step 4  
        
          
            show
            ip
            cef
            events
          
          
            summary
          
        

         
          

Use this command to display a summary of recorded Cisco Express Forwarding FIB and adjacency events. For example:


        
         

Example:
          
Router# show ip cef events summary
CEF table events summary:
     Storage for 10000 events (320000 bytes), 822/0 events recorded/ignored
     Matching all events, traceback depth 16
     Last event occurred 00:00:06.516 ago.



        
      


      
Step 5  
        
          
            show
            ip
            cef
            events
          
          
            within
          
          
            seconds
          
        

         
          

Use this command to display Cisco Express Forwarding events that occurred within (during) a specified number of seconds. For example, within 1 second:


        
         

Example:
          
Router# show ip cef events within 1
CEF table events (storage for 10000 events, 14 events recorded)
+00:00:00.000:[Default-table] *.*.*.*/*           New FIB table          [OK]
+00:00:00.000:[Default-table] 10.1.80.194/32      FIB insert in mtrie    [OK]
+00:00:00.000:[Default-table] 10.1.80.0/32        FIB insert in mtrie    [OK]
+00:00:00.000:[Default-table] 10.1.80.255/32      FIB insert in mtrie    [OK]
+00:00:00.004:[Default-table] 10.1.80.0/24        FIB insert in mtrie    [OK]
+00:00:00.004:[Default-table] 10.1.80.0/24        NBD up                 [OK]
+00:00:00.004:[Default-table] 239.224.0.0/4       FIB insert in mtrie    [OK]
+00:00:00.012:[Default-table] 10.1.80.0/24        NBD up                 [Ignr]
+00:00:00.012:[Default-table] 239.224.0.0/4       FIB remove             [OK]
+00:00:00.016:[Default-table] 239.224.0.0/4       FIB insert in mtrie    [OK]
+00:00:05.012:[Default-table] 239.224.0.0/4       FIB remove             [OK]
+00:00:05.012:[Default-table] 239.224.0.0/4       FIB insert in mtrie    [OK]
+00:00:28.440:[Default-table] 239.224.0.0/4       FIB remove             [OK]
+00:00:28.440:[Default-table] 239.224.0.0/4       FIB insert in mtrie    [OK]
First event occured at 00:00:36.568 (00:04:40.756 ago)
Last event occured at 00:01:05.008 (00:04:12.316 ago)



        
      


      
Step 6  
        
          
            exit
          
        

         
          

Use this command to exit to user EXEC mode. For example:


        
         

Example:
          
Router# exit
Router>


        
      


    














Configuration Examples for the Display of Recorded CEF Events



  


Example  Customizing CEF Event Logging



    

      

The following example shows how to enable event logging for Cisco Express Forwarding:


      
clear ip cef event-log
!
debug ip cef table
!
configure terminal
!
ip cef table event-log size 25000
exit
!


      

In this example, the Cisco Express Forwarding event log is configured to hold 25000 entries.


    


  












Additional References


 
	 
 
	 

 
	 
Related Documents
 
		 
		

 
			  
			  
			  
				
 
				   
					 
 Related Topic
					 

 
				  		
 
				   
					 
 Document Title
					 

 
				  		
 
				

 
			 
 
			  
				
 
				   
					 
 Cisco IOS commands
					 

 
				  		
 
				   
					 
 
						Cisco IOS Master Commands List, All Releases 
					 

 
				  		
 
				

 
				
 
				   
					 
 Cisco Express Forwarding commands
					 

 
				  		
 
				   
					 
 Cisco IOS IP Switching Command Reference 
					 

 
				  		
 
				

 
				
 
				   
					 
 Overview of the Cisco Express Forwarding feature
					 

 
				  		
 
				   
					 
 Cisco Express Forwarding Overview 
					 

 
				  		
 
				

 
				
 
				   
					 
 Tasks for verifying basic Cisco Express Forwarding and distributed Cisco Express Forwarding operation
					 

 
				  		
 
				   
					 
 Configuring Basic Cisco Express Forwarding for Improved Performance, Scalability, and Resiliency in Dynamic Networks 
					 

 
				  		
 
				

 
				
 
				   
					 
 Tasks for enabling or disabling Cisco Express Forwarding or distributed Cisco Express Forwarding
					 

 
				  		
 
				   
					 
 Enabling or Disabling Cisco Express Forwarding or Distributed Cisco Express Forwarding to Customize Switching and Forwarding for Dynamic Networks 
					 

 
				  		
 
				

 
				
 
				   
					 
 Tasks for configuring load-balancing schemes for Cisco Express Forwarding 
					 

 
				  		
 
				   
					 
 Configuring a Load-Balancing Scheme for Cisco Express Forwarding Traffic 
					 

 
				  		
 
				

 
				
 
				   
					 
 Tasks for configuring Cisco Express Forwarding consistency checkers
					 

 
				  		
 
				   
					 
 Configuring Cisco Express Forwarding Consistency Checkers for Route Processors and Line Cards 
					 

 
				  		
 
				

 
				
 
				   
					 
 Tasks for configuring epochs for Cisco Express Forwarding tables
					 

 
				  		
 
				   
					 
 Configuring Epochs to Clear and Rebuild Cisco Express Forwarding and Adjacency Tables 
					 

 
				  		
 
				

 
				
 
				   
					 
 Tasks for configuring and verifying Cisco Express Forwarding network accounting
					 

 
				  		
 
				   
					 
 Configuring Cisco Express Forwarding Network Accounting 
					 

 
				  		
 
				

 
				
 
				   
					 
 Tasks for customizing the display of recorded Cisco Express Forwarding events trace messages for Cisco IOS Releases 12.2(25)S, 12.2(33)SB, 12.2(33)SRA, 12.2.(33)SXH, 12.4(20)T and later releases
					 

 
				  		
 
				   
					 
 Customizing the Display of Cisco IOS Event Trace Messages 
					 

 
				  		
 
				

 
				
 
				   
					 
 Causes of common Cisco Express Forwarding-related error messages on platforms running distributed Cisco Express Forwarding switching (Cisco 7500 series routers and Cisco 12000 series Internet routers) and how to troubleshoot them
					 

 
				  		
 
				   
					 
 
						Troubleshooting Cisco Express Forwarding-Related Error Messages 
					 

 
				  		
 
				

 
			 
 
		  



 
	 

 
	 
Standards
 
		 
		

 
			  
			  
			  
				
 
				   
					 
 Standards
					 

 
				  		
 
				   
					 
 Title
					 

 
				  		
 
				

 
			 
 
			  
				
 
				   
					 
 No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.
					 

 
				  		
 
				   
					 
 --
					 

 
				  		
 
				

 
			 
 
		  



 
	 

 
	 
MIBs
 
		 
		

 
			  
			  
			  
				
 
				   
					 
 MIBs
					 

 
				  		
 
				   
					 
 MIBs Link
					 

 
				  		
 
				

 
			 
 
			  
				
 
				   
					 
 No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.
					 

 
				  		
 
				   
					 
 To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
					 

 
					 
 
						http://www.cisco.com/go/mibs 
					 

 
				  		
 
				

 
			 
 
		  



 
	 

 
	 
RFCs
 
		 
		

 
			  
			  
			  
				
 
				   
					 
 RFCs
					 

 
				  		
 
				   
					 
 Title
					 

 
				  		
 
				

 
			 
 
			  
				
 
				   
					 
 No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.
					 

 
				  		
 
				   
					 
 --
					 

 
				  		
 
				

 
			 
 
		  



 
	 

 
	 
Technical Assistance
 
		 
		

 
			  
			  
			  
				
 
				   
					 
 Description
					 

 
				  		
 
				   
					 
 Link
					 

 
				  		
 
				

 
			 
 
			  
				
 
				   
					 
 The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. 
					 

 
				  		
 
				   
					 
 
						http://www.cisco.com/cisco/web/support/index.html 
					 

 
				  		
 
				

 
			 
 
		  



 
	 

 
  










Feature Information for the Display of Recorded CEF Events


 
	 
 
		
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature. 
		

 
		
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to 
		  www.cisco.com/go/cfn. An account on Cisco.com is not required. 
		

 
	 


	 
 
		

Table 1Feature Information for Configuring the Display of Recorded Cisco Express Forwarding Events 
 
		   
		   
		   
		   
			 
 
				 
				  
 Feature Name
				  

 
						
 
				 
				  
 Releases
				  

 
						
 
				 
				  
 Feature Configuration Information
				  

 
						
 
			 

 
		  
 
		   
			 
 
				 
				  
 This table is intentionally left blank because no features were introduced or modified in Cisco IOS Release 12.2(1) or later. This table will be updated when feature information is added to this module. 
				  

 
						
 
				 
				  
 --
				  

 
						
 
				 
				  
 --
				  

 
						
 
			 

 
		  
 
		



 
	 

 
  










Glossary



    

      
        adjacency
      --A relationship formed between selected neighboring routers and end nodes for the purpose of exchanging routing information. Adjacency is based upon the use of a common media segment by the routers and nodes involved. 


    

      
        Cisco
        Express
        Forwarding
      --A Layer 3 switching technology. Cisco Express Forwarding can also refer to central Cisco Express Forwarding mode, one of two modes of Cisco Express Forwarding operation. Cisco Express Forwarding enables a Route Processor to perform express forwarding. Distributed Cisco Express Forwarding is the other mode of Cisco Express Forwarding operation.


    

      
        distributed
        Cisco
        Express
        Forwardin
      g--A mode of Cisco Express Forwarding operation in which line cards (such as Versatile Interface Processor (VIP) line cards) maintain identical copies of the forwarding information base (FIB) and adjacency tables. The line cards perform the express forwarding between port adapters; this relieves the Route Switch Processor of involvement in the switching operation.


    

      
        FIB
      --forwarding information base. A component of Cisco Express Forwarding that is conceptually similar to a routing table or information base. The router uses the FIB lookup table to make destination-based switching decisions during Cisco Express Forwarding operation. The router maintains a mirror image of the forwarding information in an IP routing table.


    

      
        line
        card
      --A general term for an interface processor that can be used in various Cisco products. For example, a Versatile Interface Processor (VIP) is a line card for the Cisco 7500 series router.


    

      
        prefix
      --The network address portion of an IP address. A prefix is specified by a network and mask and is generally represented in the format network/mask. The mask indicates which bits are the network bits. For example, 1.0.0.0/16 means that the first 16 bits of the IP address are masked, making them the network bits. The remaining bits are the host bits. In this example, the network number is 10.0.


    

      
        VPN
      --Virtual Private Network. The result of a router configuration that enables IP traffic to use tunneling to travel securely over a public TCP/IP network. 


    

      
        VRF
      --A Virtual Private Network (VPN) routing/forwarding instance. A VRF consists of an IP routing table, a derived forwarding table, a set of interfaces that use the forwarding table, and a set of rules and routing protocols that determine what goes into the forwarding table. In general, a VRF includes the routing information that defines a customer VPN site that is attached to a PE router. 


    


  










 


 
	 

		
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at 
		  www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R) 
		

 
		
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. 
		


	 

 
  



































































© 2011 Cisco Systems, Inc. All rights reserved.