Table Of Contents
Configuring System Message Logging
Understanding How the System Message Logging Works
System Log Message Format
Default System Message Logging Configuration
Configuring the System Message Logging on the Switch
Enabling and Disabling the Session Logging Settings
Setting the System Message Logging Levels
Enabling and Disabling the Logging Time-Stamp Enable State
Setting the Logging Buffer Size
Limiting the Number of syslog Messages
Configuring the syslog Daemon on a UNIX syslog Server
Configuring the syslog Servers
Displaying the Logging Configuration
Displaying the System Messages
Enabling and Disabling the System syslog Dump
Specifying the System syslog Dump Flash Device and Filename
Configuring CallHome
Disabling CallHome
Configuring System Message Logging
This chapter describes how to configure the system message logging on the Catalyst 6500 series switches.
Note
For complete syntax and usage information for the commands that are used in this chapter, refer to the Catalyst 6500 Series Switch Command Reference publication.
Note
For more information on the system messages, refer to the Catalyst 6500 Series Switch System Message Guide.
This chapter consists of these sections:
•
Understanding How the System Message Logging Works
•
System Log Message Format
•
Default System Message Logging Configuration
•
Configuring the System Message Logging on the Switch
•
Configuring CallHome
Understanding How the System Message Logging Works
The system message logging software can save messages in a log file or direct the messages to other devices. The system message logging facility has these features:
•
Provides you with logging information for monitoring and troubleshooting
•
Allows you to select the types of logging information that is captured
•
Allows you to select the destination of the captured logging information
By default, the switch logs normal but significant system messages to its internal buffer and sends these messages to the system console. You can specify which system messages should be saved based on the type of facility (see Table 29-1) and the severity level (see Table 29-2). The messages are time-stamped to enhance real-time debugging and management.
You can access the logged system messages using the switch command-line interface (CLI) or by saving them to a properly configured syslog server. The switch software saves the syslog messages in an internal buffer that can store up to 500 messages. You can monitor the system messages remotely by accessing the switch through Telnet or the console port, or by viewing the logs on a syslog server.
If a system failure occurs, the system syslog-dump allows you to write the system messages in the syslog buffer to a flash file, capturing the pertinent syslog information before the system fails. If the system core dump is enabled, the syslog is dumped before the core.
Note
The messages that are redirected to a syslog server are delayed up to 90 seconds.
Table 29-1 describes the facility types that are supported by the system message logs.
Table 29-1 System Message Log Facility Types
Facility Name
|
Definition
|
all
|
All facilities
|
acl
|
ACL facility
|
cdp
|
Cisco Discovery Protocol
|
cops
|
Common Open Policy Server
|
dtp
|
Dynamic Trunking Protocol
|
dvlan
|
Dynamic VLAN
|
earl
|
Enhanced Address Recognition Logic
|
filesys
|
File System
|
gvrp
|
GARP VLAN Registration Protocol
|
ip
|
Internet Protocol
|
kernel
|
Kernel
|
ld
|
ASLB facility
|
mcast
|
Multicast
|
mgmt
|
Management
|
mls
|
Multilayer Switching
|
pagp
|
Port Aggregation Protocol
|
protfilt
|
Protocol Filter
|
pruning
|
VTP pruning
|
privatevlan
|
Private VLAN facility
|
qos
|
Quality of Service
|
radius
|
Remote Access Dial-In User Service
|
rsvp
|
ReSerVation Protocol
|
security
|
Security
|
snmp
|
Simple Network Management Protocol
|
spantree
|
Spanning Tree Protocol
|
sys
|
System
|
tac
|
Terminal Access Controller
|
tcp
|
Transmission Control Protocol
|
telnet
|
Terminal Emulation Protocol
|
tftp
|
Trivial File Transfer Protocol
|
udld
|
User Datagram Protocol
|
vmps
|
VLAN Membership Policy Server
|
vtp
|
VLAN Trunking Protocol
|
Table 29-2 describes the severity levels that are supported by the system message logs.
Table 29-2 Severity Level Definitions
Severity Level
|
Description
|
0—emergencies
|
System unusable
|
1—alerts
|
Immediate action required
|
2—critical
|
Critical condition
|
3—errors
|
Error conditions
|
4—warnings
|
Warning conditions
|
5—notifications
|
Normal bug significant condition
|
6—informational
|
Informational messages
|
7—debugging
|
Debugging messages
|
System Log Message Format
The system log messages begin with a percent sign (%) and can contain up to 80 characters. The messages are displayed in this format:
mm/dd/yyy:hh/mm/ss:facility-severity-MNEMONIC:description
Table 29-3 describes the elements of the syslog messages.
Table 29-3 System Log Message Elements
Element
|
Description
|
mm/dd/yyy:hh/mm/ss
|
Date and time of the error or event. This information appears only if configured using the set logging timestamp enable command.
|
facility
|
Indicates the facility to which the message refers (for example, SNMP, SYS, etc.).
|
severity
|
Single-digit code from 0 to 7 that indicates the severity of the message.
|
MNEMONIC
|
Text string that uniquely describes the error message.
|
description
|
Text string containing the detailed information about the event being reported.
|
This example shows some typical switch system messages (at system startup):
1999 Apr 16 10:01:26 %MLS-5-MLSENABLED:IP Multilayer switching is enabled
1999 Apr 16 10:01:26 %MLS-5-NDEDISABLED:Netflow Data Export disabled
1999 Apr 16 10:01:26 %SYS-5-MOD_OK:Module 1 is online
1999 Apr 16 10:01:47 %SYS-5-MOD_OK:Module 3 is online
1999 Apr 16 10:01:42 %SYS-5-MOD_OK:Module 6 is online
1999 Apr 16 10:02:27 %PAGP-5-PORTTOSTP:Port 3/1 joined bridge port 3/1
1999 Apr 16 10:02:28 %PAGP-5-PORTTOSTP:Port 3/2 joined bridge port 3/2
Default System Message Logging Configuration
Table 29-4 describes the default system message logging configuration.
Table 29-4 Default System Message Logging Configuration
Configuration Parameter
|
Default Setting
|
System message logging to the console
|
Enabled
|
System message logging to Telnet sessions
|
Enabled
|
Logging buffer size
|
500 (default and maximum setting)
|
Logging history size
|
1
|
Logging history severity
|
Warnings (4)
|
Timestamp option
|
Enabled
|
Logging server
|
Disabled
|
Syslog server IP address
|
None configured
|
Server facility
|
LOCAL7
|
Server severity
|
Warnings (4)
|
Facility/severity level for system messages
|
sys/5 dtp/5 pagp/5 mgmt/5 mls/5 cdp/4 udld/4 all other facilities/2
|
System syslog dump
|
Disabled
|
System syslog-dump device and filename specifications
|
flash device is slot0:
Filename is sysloginfo
|
Configuring the System Message Logging on the Switch
These sections describe how to configure the system message logging on the switch:
•
Enabling and Disabling the Session Logging Settings
•
Setting the System Message Logging Levels
•
Enabling and Disabling the Logging Time-Stamp Enable State
•
Setting the Logging Buffer Size
•
Limiting the Number of syslog Messages
•
Configuring the syslog Daemon on a UNIX syslog Server
•
Configuring the syslog Servers
•
Displaying the Logging Configuration
•
Displaying the System Messages
•
Enabling and Disabling the System syslog Dump
•
Specifying the System syslog Dump Flash Device and Filename
Enabling and Disabling the Session Logging Settings
By default, the system logging messages are sent to the console and Telnet sessions that are based on the default logging facility and severity values. If desired, you can disable logging to the console or logging to a given Telnet session.
When you disable or enable logging to the console sessions, the enable state is applied to all future console sessions. For example, if you disable logging to the console, disconnect from the console port, and later reconnect, logging is still disabled for the console.
When you disable or enable logging to a Telnet session, the enable state is applied only to that session. If you disable logging to a Telnet session, disconnect the session, and later reconnect, logging is enabled for the new session.
Note
If you enter the set logging session command while connected through the console port, the command has the same effect as entering the set logging console command. However, if you enter the set logging console command while you are connected through a Telnet session, the default console logging enable state is changed.
To enable or disable the logging state for the console sessions, perform this task in privileged mode:
| |
Task
|
Command
|
Step 1
|
Enable or disable the default logging state for the console sessions.
|
set logging console {enable | disable}
|
Step 2
|
Verify the logging configuration.
|
show logging [noalias]
|
This example shows how to disable logging to the current and future console sessions:
Console> (enable) set logging console disable
System logging messages will not be sent to the console.
To enable or disable the logging state for the current Telnet session, perform this task in privileged mode:
| |
Task
|
Command
|
Step 1
|
Enable or disable the logging state for a Telnet session.
|
set logging session {enable | disable}
|
Step 2
|
Verify the logging configuration.
|
show logging [noalias]
|
This example shows how to disable logging to the current Telnet session:
Console> (enable) set logging session disable
System logging messages will not be sent to the current login session.
Setting the System Message Logging Levels
You can set the severity level for each logging facility using the set logging level command. Enter the all keyword to specify all facilities. Enter the default keyword to make the specified severity level the default for the specified facilities. If you do not enter the default keyword, the specified severity level applies only to the current session.
To set the system message logging severity level setting for a logging facility, perform this task in privileged mode:
| |
Task
|
Command
|
Step 1
|
Set the severity level for the logging facilities.
|
set logging level {all | facility} severity [default]
|
Step 2
|
Verify the system message logging configuration.
|
show logging [noalias]
|
This example shows how to set the logging severity level to 5 for all the facilities (for the current session only):
Console> (enable) set logging level all 5
All system logging facilities for this session set to severity 5(notifications)
This example shows how to set the default logging severity level to 3 for the cdp facility:
Console> (enable) set logging level cdp 3 default
System logging facility <cdp> set to severity 3(errors)
Enabling and Disabling the Logging Time-Stamp Enable State
To enable or disable the logging time-stamp state, perform this task in privileged mode:
| |
Task
|
Command
|
Step 1
|
Enable or disable the logging time-stamp state.
|
set logging timestamp {enable | disable}
|
Step 2
|
Verify the logging time-stamp state.
|
show logging [noalias]
|
This example shows how to enable the time-stamp display on the system logging messages:
Console> (enable) set logging timestamp enable
System logging messages timestamp will be enabled.
Setting the Logging Buffer Size
To set the number of messages to log to the logging buffer, perform this task in privileged mode:
| |
Task
|
Command
|
Step 1
|
Set the number of messages to log to the logging buffer.
|
set logging buffer buffer_size
|
Step 2
|
Verify the system message logging configuration.
|
show logging [noalias]
|
This example shows how to set the logging buffer size to 200 messages:
Console> (enable) set logging buffer 200
System logging buffer size set to <200>
Limiting the Number of syslog Messages
You can limit the number of syslog messages that are sent to the history table and the SNMP network management station based on the severity. The default severity is set to warnings(4).
To limit the number of syslog messages, perform this task in privileged mode:
| |
Task
|
Command
|
Step 1
|
Limit the number of syslog messages.
|
set logging history severity severity_level
|
Step 2
|
Verify the system message logging configuration.
|
show logging
|
This example shows how to limit the number of syslog messages to the messages with a severity level of notifications(5):
Console> (enable) set logging history severity 5
System logging history set to severity <5>
Configuring the syslog Daemon on a UNIX syslog Server
Before you can send the system log messages to a UNIX syslog server, you must configure the syslog daemon on a UNIX server. Log in as root, and perform these steps:
Step 1
Add a line such as the following to the file /etc/syslog.conf:
user.debug /var/log/myfile.log
Note
There must be five tab characters between user.debug and /var/log/myfile.log. Refer to the entries in the /etc/syslog.conf file for further examples.
The switch sends the messages according to the specified facility types and severity levels. The user keyword specifies the UNIX logging facility that is used. The messages from the switch are generated by the user processes. The debug keyword specifies the severity level of the condition being logged. You can set the UNIX systems to receive all the messages from the switch.
Step 2
Create the log file by entering these commands at the UNIX shell prompt:
$ touch /var/log/myfile.log
$ chmod 666 /var/log/myfile.log
Step 3
Make sure that the syslog daemon reads the new changes by entering this command:
$ kill -HUP `cat /etc/syslog.pid
Configuring the syslog Servers
Note
Before you can send the system log messages to a UNIX syslog server, you must configure the syslog daemon on the UNIX server as described in the "Configuring the syslog Daemon on a UNIX syslog Server" section.
To configure the switch to log messages to a syslog server, perform this task in privileged mode:
| |
Task
|
Command
|
Step 1
|
Specify the IP address of one or more syslog servers1 .
|
set logging server ip_addr
|
Step 2
|
Set the facility and severity levels for syslog server messages.
|
set logging server facility server_facility_parameter
set logging server severity server_severity_level
|
Step 3
|
Enable the system message logging to the configured syslog servers.
|
set logging server enable
|
Step 4
|
Verify the configuration.
|
show logging [noalias]
|
This example shows how to specify a syslog server, set the facility and severity levels, and enable logging to the server:
Console> (enable) set logging server 10.10.10.100
10.10.10.100 added to System logging server table.
Console> (enable) set logging server facility local5
System logging server facility set to <local5>
Console> (enable) set logging server severity 5
System logging server severity set to <5>
Console> (enable) set logging server enable
System logging messages will be sent to the configured syslog servers.
To delete a syslog server from the syslog server table, perform this task in privileged mode:
Task
|
Command
|
Delete a syslog server from the syslog server table.
|
clear logging server ip_addr
|
This example shows how to delete a syslog server from the syslog server table:
Console> (enable) clear logging server 10.10.10.100
System logging server 10.10.10.100 removed from system logging server table.
To disable logging to the syslog server, perform this task in privileged mode:
Task
|
Command
|
Disable system message logging to the configured syslog servers.
|
set logging server disable
|
This example shows how to disable logging to the syslog servers:
Console> (enable) set logging server disable
System logging messages will not be sent to the configured syslog servers.
Displaying the Logging Configuration
Enter the show logging command to display the current system message logging configuration. Enter the noalias keyword to display the IP addresses instead of the host names of the configured syslog servers.
To display the current system message logging configuration, perform this task:
Task
|
Command
|
Display the current system message logging configuration.
|
show logging [noalias]
|
This example shows how to display the current system message logging configuration:
Console> (enable) show logging
Logging buffered size: 500
timestamp option: enabled
severity: notifications(5)
server severity: warnings(4
Current Logging Session: enabled
Facility Default Severity Current Session Sever
------------- ----------------------- ---------------------
0(emergencies) 1(alerts) 2(critical)
3(errors) 4(warnings) 5(notifications)
6(information) 7(debugging)
Displaying the System Messages
Enter the show logging buffer command to display the messages in the switch logging buffer. If you do not specify number_of_messages, the default is to display the last 20 messages in the buffer (-20).
To display the messages in the switch logging buffer, perform one of these tasks:
Task
|
Command
|
Display the first number_of_messages messages in the buffer.
|
show logging buffer [number_of_messages]
|
Display the last number_of_messages messages in the buffer.
|
show logging buffer -[number_of_messages]
|
This example shows how to display the first five messages in the buffer:
Console> (enable) show logging buffer 5
1999 Apr 16 08:40:11 %SYS-5-MOD_OK:Module 1 is online
1999 Apr 16 08:40:14 %SYS-5-MOD_OK:Module 3 is online
1999 Apr 16 08:40:14 %SYS-5-MOD_OK:Module 2 is online
1999 Apr 16 08:41:15 %PAGP-5-PORTTOSTP:Port 2/1 joined bridge port 2/1
1999 Apr 16 08:41:15 %PAGP-5-PORTTOSTP:Port 2/2 joined bridge port 2/2
This example shows how to display the last five messages in the buffer:
Console> (enable) show logging buffer -5
%PAGP-5-PORTFROMSTP:Port 3/1 left bridge port 3/1
%SPANTREE-5-PORTDEL_SUCCESS:3/2 deleted from vlan 1 (PAgP_Group_Rx)
%PAGP-5-PORTFROMSTP:Port 3/2 left bridge port 3/2
%PAGP-5-PORTTOSTP:Port 3/1 joined bridge port 3/1-2
%PAGP-5-PORTTOSTP:Port 3/2 joined bridge port 3/1-2
Enabling and Disabling the System syslog Dump
If the system fails, a file containing the system messages in the syslog buffer (as displayed when entering the show logging buffer command) is produced.
To enable or disable the system syslog dump, perform this task in privileged mode (by default, the syslog dump is disabled):
| |
Task
|
Command
|
Step 1
|
Enable or disable the system syslog dump.
|
set system syslog-dump {enable | disable}
|
Step 2
|
Verify the status of the system syslog dump.
|
show system
|
This example shows how to enable the system syslog dump:
Console> (enable) set system syslog-dump enable
(1) In the event of a system crash, this feature will
cause a syslog file to be written out.
(2) Selected syslog file is slot0:sysloginfo
(3) Please make sure the above device has been installed,
This example shows how to disable the system syslog dump:
Console> (enable) set system syslog-dump disable
This example shows how to display the status of the system syslog dump:
Console> (enable) show system
Fan-Status Temp-Alarm Sys-Status Uptime d,h:m:s Logout
---------- ---------- ---------- -------------- ---------
ok off ok 1,00:03:18 20 min
------------------------ -----------------------
------------------------ -----------------------
Specifying the System syslog Dump Flash Device and Filename
You can change the flash device and the filename when the syslog dump is enabled or disabled. If you only specify the flash device, the filename is automatically set to sysloginfo. If you do not specify the flash device or the filename, the previous filename for the syslog dump is cleared and the default flash device and filename (slot0:sysloginfo) are used.
To specify the flash device and filename for the system syslog dump, perform this task in privileged mode:
| |
Task
|
Command
|
Step 1
|
Specify the flash device and filename.
|
set system syslog-file [device:[filename]]
|
Step 2
|
Verify the flash device and filename settings.
|
show system
|
This example shows how to set the flash device for the syslog dump:
Console> (enable) set system syslog-file bootflash:
Default filename sysloginfo added to the device bootflash:
This example shows how to set the flash device and the filename:
Console> (enable) set system syslog-file bootflash:sysmsgs1
This example shows how to restore the flash device and the filename to the default settings:
Console> (enable) set system syslog-file
System syslog-file set to the default file.
Configuring CallHome
You can use the CallHome feature to set your switch to e-mail or page a syslog message of a specified severity to a specified e-mail or pager address or a set of e-mail or pager addresses.
CallHome is triggered whenever a syslog message is generated. If the severity of the generated syslog message is lower than the severity that you configure, the message is not forwarded to the destination addresses that you specified. If the severity is higher than the severity that you specified, the switch forwards the syslog message to the list of destination addresses that you entered.
CallHome is tied to the syslog messages and their severity. When you set the CallHome severity level, carefully consider the level of severity that you require for the existing set logging level command and the newly introduced set logging callhome severity command.
If you configure a very fine syslog severity level, such as for alerts (level 1), and a coarse CallHome severity level, such as for notifications (level 5), the destination addresses will receive the alerts and the emergencies only (levels 0 and 1). The destination addresses do not receive the remaining CallHome severity level notifications (levels 2, 3, and 4) that you specified. To ensure that the destination addresses receive the severity level alerts and notifications for all the levels that you want, set the CallHome severity level at the same severity level, or higher, than the level that you use to set the syslog message severity.
You can configure multiple SMTP servers so that the CallHome functionality is not disrupted if one server fails. If an SMTP server fails, the switch contacts the next configured server. If you configure multiple SMTP servers, the switch uses the first available SMTP server.
To configure CallHome on your switch, perform this task in privileged mode:
| |
Task
|
Command
|
Step 1
|
Enable CallHome.
|
set logging callhome {enable | disable}
|
Step 2
|
Specify the destination e-mail or pager address where you want to receive the syslog messages and the fragment size, if necessary.
|
set logging callhome destination Email or Epage Address [fragment size in bytes]
|
Step 3
|
Specify the SMTP server IP address(es) to which the switch should dispatch the syslog messages.
|
set logging callhome smtp-server IP Address
|
Step 4
|
Specify the CallHome severity level.
Note By default, the severity level is set to critical messages only. (Level 2)
|
set logging callhome severity level
|
Step 5
|
(Optional) Set the "from" e-mail address in case the SMTP server cannot forward the syslog message.
Note The SMTP server will send a message to the "from" address for the failed deliveries.
|
set logging callhome from Email Address
|
Step 6
|
(Optional) Set the "reply to" e-mail address if you want the recipients to respond to a different address than the "from" address.
|
set logging callhome reply-to Email address
|
Step 7
|
Verify the configuration.
|
show logging callhome
|
This example shows how to enable CallHome:
Console> (enable) set logging callhome enable
Callhome functionality is enabled.
Callhome messages will be sent to the configured destination addresses.
This example shows how to set the following addresses to receive the CallHome messages:
•
page adminjoe@epage.cisco.com using a fragment size of 128 bytes
•
email adminboss@cisco.com, and adminjane@cisco.com
Console> (enable) set logging callhome destination adminjoe@epage.cisco fragment 128
Included adminjoe@epage.cisco in the table of callhome destination addresses.
Messages will be sent to this address in fragments of 128 bytes.
Console> (enable) set logging callhome destination adminjane@cisco.com
Included adminjane@cisco.com in the table of callhome destination addresses.
Messages will be sent to this address without fragmentation.
Console> (enable) set logging callhome destination adminboss@cisco.com
Included adminboss@cisco.com in the table of callhome destination addresses.
Messages will be sent to this address without fragmentation.
This example shows how to set the SMTP server with the IP address 172.16.8.19:
Console> (enable) set logging callhome smtp-server 172.20.8.16
Included 172.20.8.16 in the table of callhome SMTP servers.
This example shows how to set the severity to level 3 (critical and error messages):
Console> (enable) set logging callhome severity 3
Callhome severity level set to 3
This example shows how to set the From address to adminjoe@cisco.com:
Console> (enable) set logging callhome from adminjoe@cisco.com
From address of callhome messages is set to adminjoe@cisco.com
This example shows how to set the Reply to address to adminjane@cisco.com:
Console> (enable) set logging callhome reply-to adminjane@cisco.com
Reply-To address of callhome messages is set to adminjane@cisco.com
This example shows how to verify the configuration:
Console> (enable) show logging callhome
Callhome Functionality: enabled
Callhome Severity: LOG_ERR (3)
Destination Address Message Size
------------------- ------------
adminboss@cisco.com No Fragmentation
adminjane@cisco.com No Fragmentation
adminjoe@epage.cisco 128 bytes
Reply-To: adminjane@cisco.com
Disabling CallHome
When you disable CallHome, you do not clear any other of the CallHome parameters that are set. You need to clear each parameter individually.
To disable CallHome on your switch, perform this task in privileged mode:
Task
|
Command
|
Disable CallHome.
|
set logging callhome disable
|
This example shows how to disable CallHome:
Console> (enable) set logging callhome disable
Callhome functionality is disabled.
Callhome messages will not be sent to the configured destination addresses.
To clear an address from the list of addresses that receive CallHome messages, perform this task in privileged mode:
Task
|
Command
|
Clear a destination address from the list of addresses that receive CallHome messages.
|
clear logging callhome destination Email or Epage Address
|
This example shows how to clear the destination address adminboss@cisco.com from the list of addresses that receive CallHome messages:
Console> (enable) clear logging callhome destination adminboss@cisco.com
Removed adminboss@cisco.com from the table of callhome destination addresses.
To clear the "from" address, perform this task in privileged mode:
Task
|
Command
|
Clear the "from" address.
|
clear logging callhome from
|
This example shows how to clear the "from" address:
Console> (enable) clear logging callhome from
Cleared the from address field of callhome messages.
To clear the "reply to" address, perform this task in privileged mode:
Task
|
Command
|
Clear the "reply to" address.
|
clear logging callhome reply-to
|
This example shows how to clear the "reply to" address:
Console> (enable) clear logging callhome reply-to
Cleared the reply-to address field of callhome messages.
To clear an SMTP server from the list of CallHome SMTP servers, perform this task in privileged mode:
Task
|
Command
|
Clear an SMTP server.
|
clear logging callhome smtp-server IP Address
|
This example shows how to delete the SMTP server 172.20.8.16 from the list of CallHome servers:
Console> (enable) clear logging callhome smtp-server 172.20.8.16
Removed 172.20.8.16 from the table of callhome SMTP servers.
To clear the CallHome severity level, perform this task in privileged mode:
Task
|
Command
|
Clear the CallHome severity level.
|
clear logging callhome severity
|
This example shows how to clear the CallHome severity level:
Console> (enable) clear logging callhome severity
Cleared callhome severity level to its default value of 2(LOG_CRIT).