Table Of Contents

Alarm Management and Logging Correlation Commands on Cisco IOS XR Software

clear logging correlator delete

clear logging events delete

clear logging events reset

logging correlator apply-rule

logging correlator buffer-size

logging correlator rule

logging events buffer-size

logging events level

logging events threshold

show logging correlator buffer

show logging correlator info

show logging correlator rule

show logging events buffer

show logging events info

Alarm Management and Logging Correlation Commands on Cisco IOS XR Software

---

This chapter describes the commands used to manage alarms and configure logging correlation rules.

For detailed information about alarm management and logging correlation concepts, configuration tasks, and examples, refer to the Implementing and Monitoring Alarms and Logging Correlation on Cisco IOS XR Software module.

For more information about system logging commands, refer to the Logging Commands on Cisco IOS XR Software module. For information about system logging concepts, refer to the Implementing Logging Services on Cisco IOS XR Software module.

clear logging correlator delete

To delete all messages or messages specified by a correlation ID from the logging correlator buffer, use the clear logging correlator delete command in EXEC mode.

clear logging correlator delete {all-in-buffer | correlation-id}

Syntax Description

all-in-buffer	Clears all messages in the logging correlator buffer.
correlation-id	Correlation event record ID. Up to 32 correlation IDs can be specified, separated by a space. Range is from 0 to 4294967294.

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the show logging correlator buffer to confirm that records have been cleared.

Task ID

Task ID	Operations
logging	execute

Examples

The following example shows how to clear all records from the logging correlator buffer:

RP/0/RP0/CPU0:router# clear logging correlator delete all-in-buffer

Related Commands

Command	Description
show logging correlator buffer	Displays messages in the logging correlator buffer corresponding to a logging correlation ID or logging correlation rule name.

clear logging events delete

To delete messages from the logging events buffer, use the clear logging events delete command in EXEC mode.

clear logging events delete {[admin-level-only] [all-in-buffer] [bistate-alarms-set] [category name] [context name] [event-lo-limit event-id] [event-hi-limit event-id] [first event-count] [group message-group] [last event-count] [location node-id] [message message-code] [severity-hi-limit severity] [severity-lo-limit severity] [timestamp-hi-limit hh:mm:ss [month] [day] [year] [timestamp-lo-limit hh:mm:ss [month] [day] [year]}

Syntax Description

admin-level-only	Deletes only events at the adminstrative level.
all-in-buffer	Deletes all event IDs from the logging events buffer.
bistate-alarms-set	Deletes bi-state alarms in the SET state.
category name	Deletes events from a specified category.
context name	Deletes events from a specified context.
event-hi-limit event-id	Deletes events with an event ID equal to or lower than the event ID specified with the event-id argument. Range is from 0 to 4294967294.
event-lo-limit event-id	Deletes events with an event ID equal to or higher than the event ID specified with the event-id argument. Range is from 0 to 4294967294.
first event-count	Deletes events, beginning with the first event in the logging events buffer. For the event-count argument, enter the number of events to be deleted.
group message-group	Deletes events from a specified message group.
last event-count	Deletes events, beginning with the last event in the logging events buffer. For the event-count argument, enter the number of events to be deleted.
location node-id	Deletes messages from the logging events buffer for the specified location. The node-id argument is entered in the rack/slot/module notation.
message message-code	Deletes events with the specified message code.
severity-hi-limit severity	Deletes events with a severity level equal to or lower than the severity level specified with the severity argument. Values are: •emergencies •alerts •critical •errors •warnings •notifications •informational Note Settings for the severity levels and their respective system conditions are listed under the "Usage Guidelines" section for the logging events level command. Events of lower severity level represent events of higher importance.
severity-lo-limit severity	Deletes events with a severity level equal to or higher than the severity level specified with the severity argument. Values are: •emergencies •alerts •critical •errors •warnings •notifications •informational Note Settings for the severity levels and their respective system conditions are listed under the "Usage Guidelines" section for the logging events level command. Events of lower severity level represent events of higher importance.
timestamp-hi-limit hh:mm:ss [month] [day] [year]	Deletes events with a time stamp equal to or lower than the time stamp specified with the hh:mm:ss month day year arguments. The month, day, and year arguments default to the current month, day, and year if not specified. The ranges for the hh:mm:ss month day year arguments are as follows: •hh:—Hours. Range is 00 to 23. You must insert a colon after the hh argument. •mm:—Minutes. Range is 00 to 59. You must insert a colon after the mm argument. •ss—Seconds. Range is 00 to 59. •month—(Optional) The month of the year. The values for the month argument are: –january –february –march –april –may –june –july –august –september –october –november –december
	•day—(Optional) Day of the month. Range is from 01 to 31. •year—(Optional) Year. Enter the last two digits of the year (for example, 04 for 2004). Range is from 01 to 37.
timestamp-lo-limit hh:mm:ss [month] [day] [year]	Deletes events with a time stamp equal to or higher than the time stamp specified with the hh:mm:ss month day year arguments. The month, day, and year arguments default to the current month, day, and year if not specified. The ranges for the hh:mm:ss month day year arguments are as follows: •hh:—Hours. Range is 00 to 23. You must insert a colon after the hh argument. •mm:—Minutes. Range is 00 to 59. You must insert a colon after the mm argument. •ss—Seconds. Range is 00 to 59. •month—(Optional) The month of the year. The values for the month argument are: –january –february –march –april –may –june –july –august –september –october –november –december •day—(Optional) Day of the month. Range is from 01 to 31. •year—(Optional) Year. Enter the last two digits of the year (for example, 04 for 2004). Range is from 01 to 37.

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router. Support was introduced for the admin-level-only keyword option.
Release 3.3.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

This command is used to delete messages from the logging events buffer that match the keywords and arguments that you specify. The description is matched if all of the conditions are met.

Use the show logging events buffer command to verify that events have been cleared from the logging events buffer.

Task ID

Task ID	Operations
logging	execute

Examples

The following example shows how to delete all messages from the logging events buffer:

RP/0/RP0/CPU0:router# clear logging events delete all-in-buffer

Related Commands

Command	Description
clear logging events reset	Clears bi-state alarms in the logging events buffer.
show logging events buffer	Displays messages in the logging events buffer.

clear logging events reset

To reset bi-state alarms, use the clear logging events reset command in EXEC mode.

clear logging events reset {all-in-buffer | event-id}

Syntax DescriptionDescription

all-in-buffer	Resets all bi-state alarm messages in the event logging buffer.
event-id	Event ID. Resets the bi-state alarm for an event or events. Up to 32 event IDs can be specified, separated by a space. Range is from 0 to 4294967294.

Usage

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

This command clears bi-state alarms messages from the logging events buffer. Bi-state alarms are generated by state changes associated with system hardware, such as a change of interface state from active to inactive, or the online insertion and removal (OIR) of a Modular Service Card (MSC), or a change in component temperature.

Use the show logging events buffer command to display messages in the logging events buffer.

Task ID

Task ID	Operations
logging	execute

Examples

The following example shows how to reset all bi-alarms in the logging events buffer:

RP/0/RP0/CPU0:router# clear logging events reset all-in-buffer

Related Commands

Command	Description
clear logging events delete	Deletes all bi-state alarm messages, or messages specified by correlation ID, from the logging events buffer.
show logging events buffer	Displays messages in the logging events buffer.

logging correlator apply-rule

To apply and activate a correlation rule, use the logging correlator apply-rule command in global configuration mode. To deactivate correlation rules, use the no form of this command.

logging correlator apply-rule correlation-rule {all-of-router | context name | location node-id}

no logging correlator apply-rule correlation-rule

Syntax Description

correlation-rule	Name of the correlation rule to be applied.
all-of-router	Applies the correlation rule to the entire router.
context name	Applies the correlation rule to the specified context. Up to 32 contexts can be specified, separated by a space.
location node-id	Applies the correlation rule to the specified node. The node-id argument is entered in the rack/slot/module notation. Up to 32 locations can be specified, separated by a space.

Defaults

No correlation rules are applied.

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

This command defines the scope of the correlation rules that are applied. Messages that map to a given scope are stored in separate queues. Messages within each queue are correlated. This command is cumulative, and the same rule name can be applied to multiple scopes.

Use the show logging correlator rule command to display one or more predefined logging correlator rules.

Task ID

Task ID	Operations
logging	read, write

Examples

The following example shows how to apply a predefined correlator rule to the entire router:

RP/0/RP0/CPU0:router(config)# logging correlator apply-rule rule1 all-of-router

Related Commands

Command	Description
logging correlator rule	Defines the rules by which the correlator correlates logging messages.
show logging correlator rule	Displays one or more predefined logging correlator rules.

logging correlator buffer-size

To configure the logging correlator buffer size, use the logging correlator buffer-size command in global configuration mode. To return the buffer size to its default setting, use the no form of this command.

logging correlator buffer-size bytes

no logging correlator buffer-size bytes

Syntax Description

bytes

The size, in bytes, of the circular buffer. The range is from 1024 bytes to 524288 bytes. The default is 81290 bytes.

Defaults

bytes: 81290 bytes

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

This command configures the size of the logging correlator buffer, which is responsible for storing correlated event records.

Use the show logging correlator info command to confirm the size of the buffer and the percentage of buffer space allocated to correlated event records.

Task ID

Task ID	Operations
logging	read, write

Examples

The following example shows how to set the logging correlator buffer size to 90000 bytes:

RP/0/RP0/CPU0:router(config)# logging correlator buffer-size 90000

Related Commands

Command	Description
show logging correlator info	Displays information about the size of the logging events buffer and available capacity.

logging correlator rule

To define the rules by which the correlator logs messages to the logging events buffer, use the logging correlator rule command in global configuration mode. To disable the correlation rule, use the no form of this command.

logging correlator rule correlation-rule timeout milliseconds message-category message-group message-code

no logging correlator rule correlation-rule

Syntax Description

correlation-rule	Name of the correlation rule to be applied.
timeout milliseconds	Specifies the duration (in milliseconds) of the message collection period, beginning with the first arrival of logging messages and continuing until the time specified has expired. Range is from 1 to 600000 milliseconds.
message-category	Message category assigned to the message. Up to 10 messages (identified by message category, group, and code) can be specified, separated by a space.
message-group	Message group assigned to the message. Up to 10 messages (identified by message category, group, and code) can be specified, separated by a space.
message-code	Message code assigned to the message. Up to 10 messages (identified by message category, group, and code) can be specified, separated by a space.

Defaults

No rules are defined.

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router. Support for message categories was added for logging correlation rules.
Release 3.3.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

The logging correlator rule command defines the correlation rules used by the correlator to store messages in the logging correlator buffer. The correlator queues messages for each set of messages defined in the correlation rule separately for the duration of the timeout period. The timeout begins when the first message identified by the correlation rule is logged. When the timeout for a given correlator rule expires and a root message (the message identified by the first category, group and code triplet defined in the rule) is captured, only the root message is reported to the logging events buffer. When no root message is reported, all other messages in the queue are reported to the logging events buffer.

The root message is assigned a correlation ID number in a sequence. This number is also assigned to each unsent message in the correlator queue, and the unsent messages are stored in the logging correlation buffer. Use the show logging correlator buffer to display messages stored in the logging correlator buffer.

When the same message pair is defined in multiple rules, all matching rules are applied and the message becomes a part of the correlation queue.

Use the show logging correlator rule command to verify correlation rule settings.

Task ID

Task ID	Operations
logging	read, write

Examples

The following example shows how to define a logging correlation rule with a timeout period of 60,000 milliseconds (one minute) for the message MGBL-SYS-5-CONFIG_I (the message that is generated each time a user exits a configuration session):

RP/0/RP0/CPU0:router(config)# logging correlator rule configrule timeout 60000 MGBL SYS 
CONFIG_I

Related Commands

Command	Description
logging correlator apply-rule	Applies and activates correlation rules.
show logging correlator buffer	Displays messages in the logging correlator buffer.
show logging correlator rule	Displays one or more predefined logging correlator rules.

logging events buffer-size

To configure the size of the logging events buffer, use the logging events buffer-size command in global configuration mode. To restore the buffer size to the default value, use the no form of this command.

logging events buffer-size bytes

no logging events buffer-size bytes

Syntax Description

bytes

The size, in bytes, of the logging events buffer. The range is from 1024 bytes to 1024000 bytes. The default is 42400 bytes.

Defaults

bytes: 42400 bytes

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

---

Note The logging events buffer automatically adjusts to a multiple of the record size that is lower than or equal to the value configured for the bytes argument.

---

Use the show logging events info command to confirm the size of the logging events buffer.

Task ID

Task ID	Operations
logging	read, write

Examples

The following example shows how to increase the logging events buffer size to 50000 bytes:

RP/0/RP0/CPU0:router(config)# logging events buffer-size 50000

Related Commands

Command	Description
logging events level	Specifies a severity level for logging alarm messages.
logging events threshold	Specifies the event logging buffer capacity threshold that, when surpassed, will generate an alarm.
show logging correlator info	Displays information about the size of the logging correlator buffer and available capacity.
show logging events buffer	Displays information about the size of the logging events buffer and available capacity.
show logging events info	Displays configuration and operational messages about the logging events buffer.

logging events level

To specify a severity level for logging alarm messages, use the logging events level command in global configuration mode. To return to the default value, use the no form of this command.

logging events level severity

no logging events level

Syntax Description

severity

Severity level of events to be logged in the logging events buffer, including events of a higher severity level (numerically lower). Table 1 lists severity levels and their respective system conditions.

Defaults

All severity levels are logged.

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

This command specifies the event severity necessary for alarm messages to be logged. Severity levels can be specified by the severity level description (for example, warnings). When a severity level is specified, events of equal or lower severity level are also written to the logging events buffer.

---

Note Events of lower severity level represent events of higher importance.

---

Table 1 lists the system severity levels and their corresponding numeric values, and describes the corresponding system condition.

Table 1 Alarm Severity Levels for Event Logging  

Severity Level Keyword	Numeric Value	Logged System Messages
emergencies	0	System is unusable.
alerts	1	Critical system condition exists requiring immediate action.
critical	2	Critical system condition exists.
errors	3	Noncritical errors.
warnings	4	Warning conditions.
notifications	5	Notifications of changes to system configuration.
informational	6	Information about changes to system state.

Task ID

Task ID	Operations
logging	read, write

Examples

The following example shows how to set the severity level for notification to warnings (level 4):

RP/0/RP0/CPU0:router(config)# logging events level warnings 

Related Commands

Command	Description
logging events buffer-size	Specifies the logging events buffer size.
logging events threshold	Specifies the logging events buffer capacity threshold that, when surpassed, will generate an alarm.

logging events threshold

To specify the logging events buffer threshold that, when surpassed, generates an alarm, use the logging events threshold command in global configuration mode. To return to the default value, use the no form of this command.

logging events threshold percent

no logging events threshold

Syntax Description

percent

Minimum percentage of buffer capacity that must be allocated to messages before an alarm is generated. Range is from 10 to 100. The default is 80 percent.

Defaults

percent: 80 percent

Command Modes

Global configuration

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

This command can be configured to generate an alarm when 10 percent or more of the event buffer capacity is available.

The logging events buffer is circular; that is, when full it overwrites the oldest messages in the buffer. Once the logging events buffer reaches full capacity, the next threshold alarm is generated when the number of overwritten events surpasses the percentage of buffer capacity allocated to messages.

Use the show logging events info command to display the current threshold setting.

Task ID

Task ID	Operations
logging	read, write

Examples

The following example shows how to configure the threshold setting to 95 percent of buffer capacity:

RP/0/RP0/CPU0:router(config)# logging events threshold 95

Related Commands

Command	Description
logging events buffer-size	Specifies the logging correlator buffer size.
logging events level	Specifies a severity level for logging alarm messages.
logging events threshold	Specifies the logging events buffer capacity threshold that, when surpassed, will generate an alarm.
show logging events info	Displays configuration and operational messages about the logging events buffer.

show logging correlator buffer

To display messages in the logging correlator buffer, use the show logging correlator buffer command in EXEC mode.

show logging correlator buffer {all-in-buffer | correlationID correlation-id | rule-name correlation-rule}

Syntax Description

all-in-buffer	Displays all messages in the correlation buffer.
correlationID correlation-id	Displays a message identified by correlation ID. Up to 32 correlation IDs can be specified, separated by a space. Range is from 0 to 4294967294.
rule-name correlation- rule	Displays a messages associated with a correlation rule name. Up to 32 correlation rules can be specified, separated by a space.

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router. The output was modified to include message category information.
Release 3.3.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

This command displays messages from the logging correlator buffer that match the correlation ID or correlation rule name specified. When the all-in-buffer keyword is entered, all messages in the logging correlator buffer are displayed.

Task ID

Task ID	Operations
logging	read

Examples

The following is sample output from the show logging correlator buffer command:

RP/0/RP0/CPU0:router# show logging correlator buffer all-in-buffer

#C_id.id:Rule Name:Source  :Time                : Text

#9.1  :myrule  :RP/0/RP0/CPU0:May 15 11:40:45 2004:config[65695]: %MGBL-LIBTARCFG-6-COM

MIT : Configuration committed by user 'lab'.   Use 'show commit changes 10000005

20' to view the changes. 

#9.2  :myrule  :RP/0/RP0/CPU0:May 15 11:40:45 2004:config[65695]: %MGBL-SYS-5-CONFIG_I 

: Configured from console by lab 

Table 2 describes the significant fields shown in the display.

Table 2 show logging correlator buffer Field Descriptions 

Field	Description
C_id.	Correlation ID assigned to a event that matches a logging correlation rule.
id	An ID number assigned to each event matching a particular correlation rule. This event number serves as index to identify each individual event that has been matched for a logging correlation rule.
Rule Name	Name of the logging correlation rule that filters messages defined in a logging correlation rule to the logging correlator buffer.
Source	Node from which the event is generated.
Time	Date and time at which the event occurred.
Text	Message string that delineates the event.

Related Commands

Command	Description
show logging correlator info	Displays information about the size of the logging correlator buffer and available capacity.
show logging correlator rule	Displays one or more predefined logging correlator rules.

show logging correlator info

To display the logging correlator buffer size and the percentage of the buffer occupied by correlated messages, use the show correlator info command in EXEC mode.

show logging correlator info

Syntax Description

This command has no arguments or keywords.

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

This command displays the size of the logging correlator buffer and the percentage of the buffer allocated to correlated messages.

Use the logging correlator buffer-size command to set the size of the buffer.

Task ID

Task ID	Operations
logging	read

Examples

In the following example, the show logging correlator info command is used to display remaining buffer size and percentage allocated to correlated messages:

RP/0/RP0/CPU0:router# show logging correlator info 

Buffer-Size     Percentage-Occupied

      81920                  0.00

Related Commands

Command	Description
logging correlator buffer-size	Specifies the logging correlator buffer size.
show logging correlator buffer	Displays messages in the logging correlator buffer corresponding to a logging correlation ID or logging correlation rule name.
show logging correlator rule	Displays one or more predefined logging correlator rules.

show logging correlator rule

To display defined correlation rules, use the show logging correlator rule command in EXEC mode.

show logging correlator rule {all | correlation-rule}

Syntax Description

all	Displays all correlation rules.
correlation-rule	Correlation rule to be displayed. Up to 14 predefined correlation rules can be specified, separated by a space.

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Task ID

Task ID	Operations
logging	read

Examples

The following is sample output from the show logging correlator rule command:

RP/0/RP0/CPU0:router# show logging correlator rule test

Rule Name : test

Time out  : 3000                Rule State: RULE_APPLIED_ALL

       Code Type:       Category Group                   Message

            Root:       MGBL SYS CONFIG_I

			 Leaf: 			 MGBL 	 LIBTARCFG COMMIT

 Apply Locations:       None

  Apply Contexts:       None

Table 3 describes the significant fields shown in the display.

Table 3 show logging correlator rule Field Descriptions 

Field	Description
Rule Name	Name of defined correlation rule.
Time out	Configured timeout for the correlation rule.
Rule State	Indicates whether or not the rule has been applied. If the rule applies to the entire router, this field will display "Rule_Applied_All."
Code Type	Message category, group, and code.
Root	Message category, group and code of the root message configured in the logging correlation rule.
Leaf	Message category, group and code of a leaf message configured in the logging correlation rule.
Apply Locations	Node or nodes where the rule is applied. If the logging correlation rule applies to the entire router, this field will display "None."
Apply Contexts	Context or contexts to which the rule is applied. If the logging correlation rule is not configured to apply to a context, this field will display "None."

Related Commands

Command	Description
logging correlator apply-rule	Applies and activates correlation rules.
logging correlator rule	Defines the rules by which the correlator correlates logging messages.
show logging correlator buffer	Displays messages in the logging correlator buffer corresponding to a logging correlation ID or logging correlation rule.
show logging correlator info	Displays information about the size of the logging correlator buffer and available capacity.

show logging events buffer

To display messages in the logging events buffer, use the show logging events buffer command in EXEC mode.

show logging events buffer {[admin-level-only] [all-in-buffer] [bistate-alarms-set] [category name] [context name] [event-hi-limit event-id] [event-lo-limit event-id] [first event-count] [group message-group] [last event-count] [location node-id] [message message-code] [severity-hi-limit severity] [severity-lo-limit severity] [[timestamp-hi-limit hh:mm:ss [month] [day] [year] timestamp-lo-limit hh:mm:ss [month] [day] [year]}

Syntax Description

admin-level-only	Displays only the events that are at the adminstrative level.
all-in-buffer	Displays all event IDs in the events buffer.
bistate-alarms-set	Displays bi-state alarms in the SET state.
category name	Displays events from a specified category.
context name	Displays events from a specified context.
event-hi-limit event-id	Displays events with an event ID equal to or lower than the event ID specified with the event-id argument. Range is from 0 to 4294967294.
event-lo-limit event-id	Displays events with an event ID equal to or higher than the event ID specified with event-id argument. Range is from 0 to 4294967294.
first event-count	Displays events in the logging events buffer, beginning with the first event. For the event-count argument, enter the number of events to be displayed.
group message-group	Displays events from a specified message group.
last event-count	Displays events, beginning with the last event in the logging events buffer. For the event-count argument, enter the number of events to be displayed.
location node-id	Displays events for the specified location. The node-id argument is entered in the rack/slot/module notation.
message message-code	Displays events with the specified message code.
severity-hi-limit severity	Displays events with a severity level equal to or lower than the severity level specified with the severity argument. Values are: •emergencies •alerts •critical •errors •warnings •notifications •informational Note Settings for the severity levels and their respective system conditions are listed under the "Usage Guidelines" section for the logging events level command. Events of lower severity level represent events of higher importance.
severity-lo-limit severity	Displays events with a severity level equal to or higher than the severity level specified with the severity argument. Values are: •emergencies •alerts •critical •errors •warnings •notifications •informational Note Settings for the severity levels and their respective system conditions are listed under the "Usage Guidelines" section for the logging events level command. Events of lower severity level represent events of higher importance.
timestamp-hi-limit hh:mm:ss [month] [day] [year]	Displays events with a time stamp equal to or lower than the time stamp specified with the hh:mm:ss month day year arguments. The month, day, and year arguments default to the current month, day, and year if not specified. The ranges for the hh:mm:ss month day year arguments are as follows: •hh:—Hours. The range for hours is 00 to 23. You must insert a colon after the hh argument. •mm:—Minutes. The range for mm argument is 00 to 59. You must insert a colon after the mm argument. •ss—Seconds. The range for the ss argument is 00 to 59. •month—(Optional) The month of the year. The values for the month argument are: –january –february –march –april –may –june –july –august –september –october –november –december
	•day—(Optional) Day of the month. The day range is from 01 to 31. •year—(Optional) Year. Enter the last two digits of the year (for example, 04 for 2004). The range for the year argument is from 01 to 37.
timestamp-lo-limit hh:mm:ss [month] [day] [year]	Displays events with a time stamp equal to or higher than the time  stamp specified with the hh:mm:ss month day year arguments. The month, day, and year arguments default to the current month, day, and year if not specified. The ranges for the hh:mm:ss month day year arguments are as follows: •hh:—Hours. Range is 00 to 23. You must insert a colon after the hh argument. •mm:—Minutes. Range is 00 to 59. You must insert a colon after the mm argument. •ss—Seconds. Range is 00 to 59. •month—(Optional) The month of the year. The values for the month argument are: –january –february –march –april –may –june –july –august –september –october –november –december •day—(Optional) Day of the month. Range is from 01 to 31. •year—(Optional) Year. Enter the last two digits of the year (for example, 04 for 2004). Range is from 01 to 37.

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router. The output was modified to include message category information. The admin-level-only optional keyword was introduced.
Release 3.3.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

This command displays messages from the logging events buffer matching the description. The description is matched when all of the conditions are met.

Task ID

Task ID	Operations
logging	read

Examples

The following is sample output from the show logging events buffer all-in-buffer command:

RP/0/RP0/CPU0:router# show logging events buffer all-in-buffer

#ID    :C_id:Source  :Time                :%CATEGORY-GROUP-SEVERITY-MESSAGECODE: Text

#1     :    :RP/0/RP0/CPU0:Jan  9 08:57:54 2004:nvram[66]: %MEDIA-NVRAM_PLATFORM-3-BAD_N

VRAM_VAR : ROMMON variable-value pair: '^['[19~CONFIG_FILE = disk0:config/startu

p, contains illegal (non-printable)characters 

#2     :    :RP/0/RP0/CPU0:Jan  9 08:58:21 2004:psarb[238]: %PLATFORM-PSARB-5-GO_BID : 
Card

 is going to bid state. 

#3     :    :RP/0/RP0/CPU0:Jan  9 08:58:22 2004:psarb[238]: %PLATFORM-PSARB-5-GO_ACTIVE : 
C

ard is becoming active. 

#4     :    :RP/0/RP0/CPU0:Jan  9 08:58:22 2004:psarb[238]: %PLATFORM- 
PSARB-6-RESET_ALL_LC_

CARDS : RP going active; resetting all linecards in chassis 

#5     :    :RP/0/RP0/CPU0:Jan  9 08:58:22 2004:redcon[245]: %HA-REDCON-6-GO_ACTIVE :

 this card going active 

#6     :    :RP/0/RP0/CPU0:Jan  9 08:58:22 2004:redcon[245]: %HA-REDCON-6-FAILOVER_EN

ABLED : Failover has been enabled by config 

Table 4 describes the significant fields shown in the display.

Table 4 show logging correlator buffer Field Descriptions 

Field	Description
#ID	Integer assigned to each event in the logging events buffer.
C_id.	Correlation ID assigned to a event that has matched a logging correlation rule.
Source	Node from which the event is generated.
Time	Date and time at which the event occurred.
%CATEGORY-GROUP-SEVERITY-MESSAGECODE	The category, group name, severity level, and message code associated with the event.
Text	Message string that delineates the event.

Related Commands

Command	Description
show logging events info	Displays configuration and operational messages about the logging events buffer.

show logging events info

To display configuration and operational information about the logging events buffer, use the show logging events info command in EXEC mode.

show logging events info

Syntax Description

This command has no arguments or keywords.

Command Modes

EXEC

Command History

Release	Modification
Release 2.0	This command was introduced on the Cisco CRS-1.
Release 3.0	No modification.
Release 3.2	This command was first supported on the Cisco XR 12000 Series Router.
Release 3.3.0	No modification.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

This command displays information about the size of the logging events buffer, the maximum size of the buffer, the number of records being stored, the maximum allowable number of records threshold for circular filing, and message filtering.

Task ID

Task ID	Operations
logging	read

Examples

The following is sample output from the show logging events info command:

RP/0/RP0/CPU0:router# show logging events info

Size (Current/Max)      #Records       Thresh     Filter

16960     /42400          37             90        Not Set

Table 5 describes the significant fields shown in the display.

Table 5 show logging events info Field Descriptions 

Field	Description
Size (Current/Max)	The current and maximum size of the logging events buffer. The maximum size of the buffer is controlled by the logging events buffer-size command.
#Records	The number of event records stored in the logging events buffer.
Thresh	The configured logging events threshold value. This field is controlled by the logging events threshold command.
Filter	The lowest severity level for events that will be displayed. This field is controlled by the logging events level command.

Related Commands

Command	Description
logging events buffer-size	Specifies the logging correlator buffer size.
logging events level	Specifies a severity level for logging alarm messages.
logging events threshold	Specifies the logging events buffer capacity threshold that, when surpassed, will generate an alarm.
show logging events buffer	Displays information about messages in the logging events buffer according to type, time, or severity level.