BGP Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Release

PDF

Syslog messages for BGP attribute filtering

Updated: February 28, 2026

Want to summarize with AI?

Log in

Overview

Explains syslog messages generated during BGP attribute filtering to assist in monitoring and troubleshooting.

A BGP syslog message is a notification that

  • indicates an event related to BGP error handling or attribute filtering

  • is generated when a router receives a malformed update packet or filters attributes, and

  • is rate-limited to prevent excessive logging.

BGP error syslog message

%ROUTING-BGP-3-MALFORM_UPDATE : Malformed UPDATE message received from neighbor 192.0.2.1
- message length 90 bytes,
error flags 0x00000840, action taken "TreatAsWithdraw".
Error details: "Error 0x00000800, Field "Attr-missing", Attribute 1 (Flags 0x00, Length 0), Data []"

BGP attribute filtering syslog message for the discard attribute action

4843.46]RP/0/0/CPU0:Aug 21 17:06:17.919 : bgp[1037]: %ROUTING-BGP-5-UPDATE_FILTERED :
One or more attributes were filtered from UPDATE message received from neighbor 192.0.2.1
- message length 173 bytes, action taken "DiscardAttr".
Filtering details: "Attribute 16 (Flags 0xc0): Action "DiscardAttr"". NLRIs: [IPv4 Unicast] 88.2.0.0/17

BGP attribute filtering syslog message for the treat-as-withdraw action

[391.01]RP/0/0/CPU0:Aug 20 19:41:29.243 : bgp[1037]: %ROUTING-BGP-5-UPDATE_FILTERED :
One or more attributes were filtered from UPDATE message received from neighbor 192.0.2.1
- message length 166 bytes, action taken "TreatAsWdr".
Filtering details: "Attribute 4 (Flags 0xc0): Action "TreatAsWdr"". NLRIs: [IPv4 Unicast]

How malformed BGP updates generate syslog messages

Summary

The key components involved in the process are:

  • Router: Receives malformed BGP update packets.

  • System: Prints ios_msg to the console and applies rate-limiting.

  • ios_msg (ROUTING-BGP-3-MALFORM_UPDATE): The specific syslog message generated for malformed update packets.

  • Neighbors: BGP peers from which malformed updates are received.

  • Discard Attribute (A5) / Local Repair (A6) actions: Specific responses to certain malformed packets.

The system handles malformed BGP update packets by generating specific syslog messages (ios_msg) that are rate-limited to prevent excessive logging, with different logging behaviors for general malformations versus those leading to specific attribute filtering actions.

Workflow

These stages describe how malformed BGP updates generate syslog messages.

  1. A router receives a malformed update packet.
  2. The system prints an ios_msg of type ROUTING-BGP-3-MALFORM_UPDATE on the console.
  3. The system rate-limits this message to one per minute across all neighbors.
  4. If malformed packets trigger Discard Attribute (A5) or Local Repair (A6) actions:
    • The system prints the ios_msg only once per neighbor per action.
    • This printing behavior is independent of the number of malformed updates received since the neighbor last reached an Established state.

Result

The system provides controlled and informative logging of BGP malformation events, ensuring you are aware of issues without overwhelming the console with duplicate messages.