System Monitoring Command Reference for Cisco NCS 5500 Series, Cisco NCS 540 Series, and Cisco NCS 560 Series Routers

archive-length

To specify the length of time that logs are maintained in the logging archive, use the archive-length command in logging archive configuration mode. To return to the default, use the no form of this command.

archive-length weeks

no archive-length

Syntax Description


`weeks`	Length of time (in weeks) that logs are maintained in the archive. Range is 0 to 4294967295.

Command Default

weeks : 4 weeks

Command Modes

Logging archive configuration

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

Use the archive-length command to specify the maximum number of weeks that the archive logs are maintained in the archive. Any logs older than this number are automatically removed from the archive.

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to set the log archival period to 6 weeks:


RP/0/RP0/CPU0:router(config)# logging archive
RP/0/RP0/CPU0:router(config-logging-arch)# archive-length 6

archive-size

To specify the amount of space allotted for syslogs on a device, use the archive-size command in logging archive configuration mode. To return to the default, use the no form of this command.

archive-size size

no archive-size

Syntax Description


`size`	Amount of space (in MB) allotted for syslogs. The range is 0 to 2047.

Command Default

size : 20 MB

Command Modes

Logging archive configuration

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

Use the archive-length command to specify the maximum total size of the syslog archives on a storage device. If the size is exceeded, then the oldest file in the archive is deleted to make space for new logs.

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to set the allotted space for syslogs to 50 MB:


RP/0/RP0/CPU0:router(config)# logging archive
RP/0/RP0/CPU0:router(config-logging-arch)# archive-size 50

clear logging

To clear system logging (syslog) messages from the logging buffer, use the clear logging command in XR EXEC mode.

clear logging

Syntax Description

This command has no keywords or arguments.

Command Default

None

Command Modes

XR EXEC mode

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

Use the clear logging command to empty the contents of the logging buffer. When the logging buffer becomes full, new logged messages overwrite old messages.

Use the logging buffered command to specify the logging buffer as a destination for syslog messages, set the size of the logging buffer, and limit syslog messages sent to the logging buffer based on severity.

Use the show logging command to display syslog messages stored in the logging buffer.

Task ID


Task ID	Operations
logging	execute

Examples

This example shows how to clear the logging buffer:


RP/0/RP0/CPU0:router# clear logging

Clear logging buffer [confirm] [y/n] :y

device

To specify the device to be used for logging syslogs, use the device command in logging archive configuration mode. To return to the default, use the no form of this command.

device {disk0 | disk1 | harddisk}

no device

Syntax Description


disk0	Uses disk0 as the archive device.
disk1	Uses disk1 as the archive device.
harddisk	Uses the harddisk as the archive device.

Command Default

None

Command Modes

Logging archive configuration

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

Use the device command to specify where syslogs are logged. The logs are created under the directory <device>/var/log. If the device is not configured, then all other logging archive configurations are rejected. Similarly, the configured device cannot be removed until the other logging archive configurations are removed.

It is recommended that the syslogs be archived to the harddisk because it has more capacity.

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to specify disk1 as the device for logging syslog messages:


RP/0/RP0/CPU0:router(config)# logging archive
RP/0/RP0/CPU0:router(config-logging-arch)# device disk1

file-size

To specify the maximum file size for a log file in the archive, use the file-size command in logging archive configuration mode. To return to the default, use the no form of this command.

file-size size

no file-size

Syntax Description


`size`	Maximum file size (in MB) for a log file in the logging archive. The range is 1 to 2047.

Command Default

size : 1 MB

Command Modes

Logging archive configuration

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

Use the file-size command to specify the maximum file size that a single log file in the archive can grow to. Once this limit is reached, a new file is automatically created with an increasing serial number.

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to set the maximum log file size to 10 MB:


RP/0/RP0/CPU0:router(config)# logging archive
RP/0/RP0/CPU0:router(config-logging-arch)# file-size 10

logging

To specify a system logging (syslog) server host as the recipient of syslog messages, use the logging command in XR Config mode. To remove the logging command from the configuration file and delete a syslog server from the list of syslog server hosts, use the no form of this command.

logging { ip-address | hostname | { vrf | vrf_name } } { archive | buffered | console | correlator | disable | events | facility | history | hostnameprefix | localfilesize | monitor | source-address | source-interface | suppress | trap | severity }

no logging { ip-address | hostname | { vrf | vrf_name } } { archive | buffered | console | correlator | disable | events | facility | history | hostnameprefix | localfilesize | monitor | source-address | source-interface | suppress | trap | severity }

Syntax Description


`ip-address` \| `hostname`	IP address or hostname of the host to be used as a syslog server.
vrf `vrf-name`	Name of the VRF. Maximum length is 32 alphanumeric characters.
archive	Specifies logging to a persistent device(disk/harddisk).
buffered	Sets buffered logging parameters.
console	Sets console logging.
correlator	Configures properties of the event correlator
disable	Disables console logging.
events	Configures event monitoring parameters.
facility	Modifies message logging facilities.
history	Sets history logging.
hostnameprefix	Adds the hostname prefix to messages on servers.
localfilesize	Sets size of the local log file.
monitor	Sets monitor logging
source-address	Specifies source address of the logging host.
source-interface	Specifies interface for source address in logging transactions.
suppress	Configures properties for the event suppression.
trap	Sets trap logging.
severity	Set severity of messages for particular remote host/vrf.
{all\|none} [port `number`] [vrf `name`]	All or no severity logs are logged to the syslog server, respectively. This set of options is added under severity. port `number` - For the `number` argument, you can use default option or the port number.

Command Default

No syslog server hosts are configured as recipients of syslog messages.

Command Modes

XR Config mode

Command History


Release	Modification
Release 6.0	This command was introduced.
Release 7.4.1	The all and none keywords were added under the logging severity command form.
Release 7.10.1	The facility and source-address options per remote syslog server were introduced.

Usage Guidelines

command form.

Use the logging command to identify a syslog server host to receive messages. By issuing this command more than once, you build a list of syslog servers that receive messages.

When syslog messages are sent to a syslog server, the Cisco IOS XR software includes a numerical message identifier in syslog messages. The message identifier is cumulative and sequential. The numerical identifier included in syslog messages sent to syslog servers provides a means to determine if any messages have been lost.

Use the logging trap command to limit the messages sent to snmp server.

Amongst other options, all and none are provided under the logging severity command form. If you enable all or none , all or no severity logs are logged to the syslog server, respectively. This configuration persists even when you enable a specific operator type.

The configurations for facility and source-address per remote syslog server takes priority over global configuration.

Examples

This example shows how to log messages to a host named host1:


RP/0/RP0/CPU0:router(config)# logging host1

RP/0/RP0/CPU0:router(config)#logging A.B.C.D
  severity  Set severity of  messages for particular remote host/vrf
  vrf       Set VRF option

RP/0/RP0/CPU0:router(config)#logging A.B.C.D
RP/0/RP0/CPU0:router(config)#commit
Wed Nov 14 03:47:58.976 PST

RP/0/RP0/CPU0:router(config)#do show run logging
Wed Nov 14 03:48:10.816 PST
logging A.B.C.D vrf default severity info

Note

Default level is severity info.

Configuration Example for Facility and Source-address Per Remote Syslog Server

This example shows how to configure facility and source-address per remote syslog server:

Router#configure
Router(config)#
Router(config)#logging 209.165.201.1 source-address 209.165.201.2
Router(config)#logging 209.165.201.1 facility local2
Router(config)#commit

logging archive

To configure attributes for archiving syslogs, use the logging archive command in XR Config mode. To exit the logging archive submode, use the no form of this command.

logging archive

no logging archive

Syntax Description

This command has no keywords or arguments.

Command Default

None

Command Modes

XR Config mode

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

Use the logging archive command to configure attributes for archiving syslogs. This command enters logging archive configuration mode and allows you to configure the commands in the table:

Note

The configuration attributes must be explicitly configured in order to use the logging archive feature.

Table 1. Configuring Command Attributes For Archiving Syslogs
Command	Range	Description	Recommended Setting
archive-length	<0-4294967295>	Number of weeks	4 weeks
archive-size	<1-2047>	Size in MB	20 MB
device	<disk0 \| disk1 \| harddisk>	Use configured devices as the archive device.	harddisk
file-size	<1-2047>	Size in MB	1 MB
frequency	<daily \| weekly>		daily
severity	<alerts \| critical \| debugging \| emergencies \| errors \| informational \| notifications \| warnings>		informational

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to enter logging archive configuration mode and change the device to be used for logging syslogs to disk1:


RP/0/RP0/CPU0:router(config)# logging archive
RP/0/RP0/CPU0:router(config-logging-arch)# device disk1

logging buffered

To send system logging (syslog) messages to logging buffer, use the logging buffered command in XR Config mode. To return to the default, use the no form of the logging buffered command.

logging buffered { buffer-size | | | alerts | critical | | | debugging | | | discriminator | | | emergencies | errors | | | informational | | | notifications | | | warnings | | | entries-count | count }

Syntax Description


`buffer-size`	Size of the buffer, in bytes. Range is 2097152-125000000 bytes. The default is 2097152 bytes.
entries-count `count`	Specifies the buffer entries-count of syslog messages you want to see. The default value is 2545. The range is 2545-151699.
alerts	Specifies if any immediate action is needed
critical	Specifies critical conditions
debugging	Specifies debugging messages
discriminator	Sets logging buffer discriminator
emergencies	Specifies system is unusable
informational	Specifies informational messages
notifications	Specifies normal but significant conditions
warnings	Specifies warning conditions

Command Default

None

Command Modes

XR Config mode

XR Config Mode

Command History


Release	Modification
Release 7.11.1	This command was modified to include entries-count option.
Release 6.0	This command was introduced.

Usage Guidelines

Use the logging buffered command to copy messages to the logging buffer. The logging buffer is circular, so newer messages overwrite older messages after the buffer is filled. This command is related to the show logging buffer command, which means that when you execute a logging buffered warnings command, it enables the logging for all the levels below the configured level, including log for LOG_ERR, LOG_CRIT, LOG_ALERT, LOG_EMERG, and LOG_WARNING messages. Use the logging buffersize to specify the size of the buffer. Use the logging buffer entries-count command to specify the count of syslog entries.

If both the logging buffered bytes and logging buffered entries-count commands are present, then the maximum configured value is taken to display the number of system log messages.

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows the configuration for sending syslog messages to the logging buffer:


RP/0/RP0/CPU0:router(config)# logging buffered 3000000

This example shows how to specify the count of syslog entries.

Router# configure
Router(config)# logging buffered entries-count 3000
Router(config)# commit

logging console

To enable logging of system logging (syslog) messages logged to the console by severity level, use the logging console command in XR Config mode. To return console logging to the default setting, use the no form of this command.

logging console { severity | disable }

no logging console

Syntax Description


`severity`	Severity level of messages logged to the console, including events of a higher severity level (numerically lower). The default is informational . Settings for the severity levels and their respective system conditions are listed in the table under the “Usage Guidelines” section.
disable	Removes the logging console command from the configuration file and disables logging to the console terminal.

Command Default

By default, logging to the console is enabled.

severity: informational

Command Modes

XR Config mode

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

Use the logging console command to prevent debugging messages from flooding your screen.

The logging console is for the console terminal. The value specified for the severity argument causes messages at that level and at numerically lower levels (higher severity levels) to be displayed on the console.

Use the logging console disable command to disable console logging completely.

Use the no logging console command to return the configuration to the default setting.

Use the show logging command to display syslog messages stored in the logging buffer.

The value specified for the severity argument causes messages at that level and at numerically lower levels to be displayed on the console terminal. See the table for a list of the possible severity level keywords for the severity argument.

This table describes the acceptable severity levels for the severity argument.

Table 2. Severity Levels for Messages
Level Keywords	Level	Description	Syslog Definition
emergencies	0	Unusable system	LOG_EMERG
alerts	1	Need for immediate action	LOG_ALERT
critical	2	Critical condition	LOG_CRIT
errors	3	Error condition	LOG_ERR
warnings	4	Warning condition	LOG_WARNING
notifications	5	Normal but significant condition	LOG_NOTICE
informational	6	Informational message only	LOG_INFO
debugging	7	Debugging message	LOG_DEBUG

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to change the level of messages displayed on the console terminal to alerts (1), which means that alerts (1) and emergencies (0) are displayed:


RP/0/RP0/CPU0:router(config)# logging console alerts

This example shows how to disable console logging:


RP/0/RP0/CPU0:router(config)# logging console disable

This example shows how to return console logging to the default setting (the console is enabled, severity: informational ):


RP/0/RP0/CPU0:router# no logging console

logging console disable

To disable logging of system logging (syslog) messages logged to the console, use the logging console disable command in XR Config mode. To return logging to the default setting, use the no form of this command.

logging console disable

no logging console disable

Syntax Description

This command has no keywords or arguments.

Command Default

By default, logging is enabled.

Command Modes

XR Config mode

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

Use the logging console disable command to disable console logging completely.

Use the no logging console disable command to return the configuration to the default setting.

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to disable syslog messages:


RP/0/RP0/CPU0:router(config)# logging console disable

logging container all

To enable logging of messages from third-party software containers, use the logging container all command in XR Config mode. To disable logging messages from third-party containers, use the no form of this command.

logging container all

no logging container all

Syntax Description


container	Enables the logging of messages from third-party software containers.
all	Specifies all running containers in the device.

Command Default

By default, logging is disabled.

Command Modes

XR Config mode

Command History


Release	Modification
Release 6.6.4	This command was introduced.

Usage Guidelines

None.

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to enable third-party software container logging and how to view the logs for the third-party software named docker :


Router(config)# logging container all
Router(config)# commit
Router(config)# do show running-config logging
logging container all\
Router(config)# do show logging | inc DOCKER
Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)
    Console logging: level warnings, 5 messages logged
    Monitor logging: level debugging, 0 messages logged
    Trap logging: level informational, 0 messages logged
    Buffer logging: level debugging, 148 messages logged

Log Buffer (2097152 bytes):

RP/0/RP0/CPU0:Jul  5 06:56:11.913 UTC: exec[66927]: %SECURITY-LOGIN-6-AUTHEN_SUCCESS : Successfully authenticated user 'lab' from 'console' on 'con0_RP0_CPU0'
RP/0/RP0/CPU0:Jul  5 06:58:13.053 UTC: config[66985]: %MGBL-SYS-5-CONFIG_I : Configured from console by lab 
RP/0/RP0/CPU0:Jul  5 06:59:04.775 UTC: ubuntu-1[67232]: %OS-SYSLOG-6-DOCKER_APP : ^[]0;root@c382b2e7bed6: /^Groot@c382b2e7bed6:/# testlog 
RP/0/RP0/CPU0:Jul  5 06:59:04.830 UTC: config[67139]: %MGBL-CONFIG-6-DB_COMMIT : Configuration committed by user 'lab'. Use 'show configuration commit changes 1000000012' to view the changes. 
RP/0/RP0/CPU0:Jul  5 06:59:45.028 UTC: config[67139]: %MGBL-SYS-5-CONFIG_I : Configured from console by lab 
RP/0/RP0/CPU0:Jul  5 06:59:48.552 UTC: run_cmd[67780]: %INFRA-INFRA_MSG-5-RUN_LOGIN : User lab logged into shell from con0/RP0/CPU0 
RP/0/RP0/CPU0:Jul  5 06:59:56.073 UTC: ubuntu-1[67976]: %OS-SYSLOG-6-DOCKER_APP : testlog-123 
RP/0/RP0/CPU0:Jul  5 07:00:12.471 UTC: ubuntu-1[68099]: %OS-SYSLOG-6-DOCKER_APP : testlog-new1 
RP/0/RP0/CPU0:Jul  5 07:01:55.747 UTC: ubuntu-1[68245]: %OS-SYSLOG-6-DOCKER_APP : testlog-new1 
RP/0/RP0/CPU0:Jul  5 07:02:02.869 UTC: run_cmd[67780]: %INFRA-INFRA_MSG-5-RUN_LOGOUT : User lab logged out of shell from con0/RP0/CPU0

logging events link-status

To enable the logging of link-status system logging (syslog) messages for logical and physical links, use the logging events link-status command in XR Config mode. To disable the logging of link status messages, use the no form of this command.

logging events link-status {disable | software-interfaces}

no logging events link-status [disable | software-interfaces]

Syntax Description


disable	Disables the logging of link-status messages for all interfaces, including physical links.
software-interfaces	Enables the logging of link-status messages for logical links as well as physical links.

Command Default

The logging of link-status messages is enabled for physical links.

Command Modes

XR Config mode

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

When the logging of link-status messages is enabled, the router can generate a high volume of link-status up and down system logging messages.

Use the no logging events link-status command to enable the logging of link-status messages for physical links only, which is the default behavior.

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to disable the logging of physical and logical link-status messages:


RP/0/RP0/CPU0:router(config)# logging events link-status disable

logging facility

To configure the type of syslog facility in which system logging (syslog) messages are sent to syslog servers, use the logging facility command in XR Config mode. To remove the logging facility command from the configuration file and disable the logging of messages to any facility type, use the no form of this command.

logging facility [type]

no logging facility

Syntax Description


`type`	(Optional) Syslog facility type. The default is local7 . Possible values are listed under Table 1 in the “Usage Guidelines” section.

Command Default

type: local7

Command Modes

XR Config mode

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

This table describes the acceptable options for the type argument.

Table 3. Facility Type Descriptions
Facility Type	Description
auth	Authorization system
cron	Cron/at facility
daemon	System daemon
kern	Kernel
local0	Reserved for locally defined messages
local1	Reserved for locally defined messages
local2	Reserved for locally defined messages
local3	Reserved for locally defined messages
local4	Reserved for locally defined messages
local5	Reserved for locally defined messages
local6	Reserved for locally defined messages
local7	Reserved for locally defined messages
lpr	Line printer system
mail	Mail system
news	USENET news
sys9	System use
sys10	System use
sys11	System use
sys12	System use
sys13	System use
sys14	System use
syslog	System log
user	User process
uucp	UNIX-to-UNIX copy system

Use the command to specify a syslog server host as a destination for syslog messages.

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to configure the syslog facility to the kern facility type:


RP/0/RP0/CPU0:router(config)# logging facility kern

logging file

To specify the file to store system logs on the router, use the logging file command in XR Config Mode.

logging file filename path pathname [ local-accounting [ maxfilesize max-file-size | severity severity | send-to-remote facility facility-type ] ]

Syntax Description


`filename`	Specifies the filename of the log file.
path `pathname`	Specifies the location to save the logging file.
local-accounting	(optional) Enables the storage of the AAA command-accounting logs directly on the router, in the file specified in `pathname`
maxfilesize `max-file-size`	(optional) Specifies the maximum file size of the logging file in bytes. Range is from 1 to 2097152 (in KB). Default is 2 GB.
severity `severity`	(optional) Specifies the severity level for the logging file. Default is informational. alerts - Immediate action needed (severity=1) critical - Critical conditions (severity=2) debugging - Debugging messages (severity=7) emergencies - System is unusable (severity=0) errors - Error conditions (severity=3) informational - Informational messages (severity=6) notifications - Normal but significant conditions (severity=5) warnings - Warning conditions (severity=4)
send-to-remote	(optional) Enables the command accounting logs to be sent to the syslog server
facility `facility-type`	(optional) Specifies the facility from which the command accounting logs are generated. Facility is the identifier used by the remote logging server to identify the application or process that generated the log message. The available facility-types are listed under Usage Guidelines.

Command Default

This feature is disabled by default.

Command Modes

XR Config Mode

Command History


Release	Modification
Release 6.0	This command was introduced.
Release 7.4.1	The local-accounting option is introduced.

Usage Guidelines

If the logs generated exceeds the maximum file size, then the router over-writes the existing file contents.

The following table describes the available options for facility-type :

Table 4. Facility Types
Facility Type	Description
auth	Authorization system
cron	Cron/at facility
daemon	System daemon
kern	Kernel
local0	Reserved for locally defined messages
local1	Reserved for locally defined messages
local2	Reserved for locally defined messages
local3	Reserved for locally defined messages
local4	Reserved for locally defined messages
local5	Reserved for locally defined messages
local6	Reserved for locally defined messages
local7	Reserved for locally defined messages
lpr	Line printer system
mail	Mail system
news	USENET news
sys9	System use
sys10	System use
sys11	System use
sys12	System use
sys13	System use
sys14	System use
syslog	System log
user	User process
uucp	UNIX-to-UNIX copy system

Task ID


Task ID	Operation
logging	read, write

Examples

This example shows how to enable local command accounting after configuring the AAA command accounting feature:

Router#conf t
Router(config)#aaa accounting commands default start-stop group tacacs+ local
Router(config)#logging file cmdacctfile path /disk0: maxfilesize 1024 severity info local-accounting send-to-remote facility local7
Router(config)#commit

logging format bsd

To send system logging messages to a remote server in Berkeley Software Distribution (BSD) format, use the logging format bsd command in XR Config mode. To return console logging to the default setting, use the no form of this command.

logging format bsd

Syntax Description


format	Specifies the format of the syslog messages sent to the server.
bsd	Configures the format of the syslog messages according to the BSD format.

Command Default

By default, this feature is disabled.

Command Modes

XR Config mode

Command History


Release	Modification
Release 7.1.2	This command was introduced.

Usage Guidelines

None.

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to log messages to a server, in the BSD format:

Router(config)#logging 209.165.200.225 vrf default severity info
Router(config)#logging format bsd
Router(config)#commit

Router(config)#do show run logging
logging format bsd
logging 209.165.200.225 vrf default severity info

logging hostnameprefix

To append a hostname prefix to system logging (syslog) messages logged to syslog servers, use the logging hostnameprefix command in XR Config mode. To remove the logging hostnameprefix command from the configuration file and disable the logging host name prefix definition, use the no form of this command.

logging hostnameprefix hostname

no logging hostnameprefix

Syntax Description


`hostname`	Hostname that appears in messages sent to syslog servers.

Command Default

No hostname prefix is added to the messages logged to the syslog servers.

Command Modes

XR Config mode

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

Use the logging hostnameprefix command to append a hostname prefix to messages sent to syslog servers from the router. You can use these prefixes to sort the messages being sent to a given syslog server from different networking devices.

Use the command to specify a syslog server host as a destination for syslog messages.

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to add the hostname prefix host1 to messages sent to the syslog servers from the router:


RP/0/RP0/CPU0:router(config)# logging hostnameprefix host1

logging source-interface

To set all system logging (syslog) messages being sent to syslog servers to contain the same IP address, regardless of which interface the syslog message uses to exit the router, use the logging source-interface command in XR Config mode. To remove the logging source-interface command from the configuration file and remove the source designation, use the no form of this command.

logging source-interface type interface-path-id

no logging source-interface

Syntax Description

type

Interface type. For more information, use the question mark (? ) online help function.

interface-path-id

Physical interface or virtual interface.

Note

Use the show interfaces command to see a list of all interfaces currently configured on the router.

For more information about the syntax for the router, use the question mark (? ) online help function.

Command Default

No source IP address is specified.

Command Modes

XR Config mode

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

Normally, a syslog message contains the IP address of the interface it uses to leave the networking device. Use the logging source-interface command to specify that syslog packets contain the IP address of a particular interface, regardless of which interface the packet uses to exit the networking device.

Use the command to specify a syslog server host as a destination for syslog messages.

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to specify that the IP address for HundredGigE interface 0/1/0/0 be set as the source IP address for all messages:


RP/0/RP0/CPU0:router(config)# logging source-interface HundredGigE interface 0/1/0/0

logging suppress duplicates

To prevent the consecutive logging of more than one copy of the same system logging (syslog) message, use the logging suppress duplicates command in XR Config mode. To remove the logging suppress duplicates command from the configuration file and disable the filtering process, use the no form of this command.

logging suppress duplicates

no logging suppress duplicates

Syntax Description

This command has no keywords or arguments.

Command Default

Duplicate messages are logged.

Command Modes

XR Config mode

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

If you use the logging suppress duplicates command during debugging sessions, you might not see all the repeated messages and could miss important information related to problems that you are attempting to isolate and resolve. In such a situation, you might consider disabling this command.

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to suppress the consecutive logging of duplicate messages:


RP/0/RP0/CPU0:router(config)# logging suppress duplicates

logging trap

To specify the severity level of messages logged to snmp server, use the logging trap command in XR Config mode. To restore the default behavior, use the no form of this command.

logging trap [severity]

no logging trap

Syntax Description


`severity`	(Optional) Severity level of messages logged to the snmp server, including events of a higher severity level (numerically lower). The default is informational . Settings for the severity levels and their respective system conditions are listed under Table 1 in the “Usage Guidelines” section for the logging buffered command.

Command Default

severity: informational

Command Modes

XR Config mode

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

Use the logging trap command to limit the logging of messages sent to snmp servers to only those messages at the specified level.

b-ncs5500-system-monitoring-cli-reference_chapter_011.html#wp3749705429__ under the “Usage Guidelines” section for the logging buffered command lists the syslog definitions that correspond to the debugging message levels.

Use the command to specify a syslog server host as a destination for syslog messages.

The logging trap disable will disable the logging of messages to both snmp server and syslog servers.

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to restrict messages to notifications (5) and numerically lower levels.


RP/0/RP0/CPU0:router(config)# logging trap notifications

login-history

To enable the display of the login banner in compliance with US DoD login notification requirements, use the login-history enable command in the XR Config mode. To disable the display of the login banner, use the login-history disable command in the XR Config mode.

login-history { enable | disable }

Command Default

The display of the login banner is not enabled.

Command History


Release	Modification
Release 7.3.1	This command was introduced.

Task ID


Task ID	Operations
aaa	read, write

Examples

This example shows how to enable and disable the display of the login banner in compliance with the US DoD login notification requirements:


Router(config-un)# login-history enable
Router(config-un)# login-history disable

If you enable the login banner, you can display the login notification banner that conforms to the US (DOD) requirements:

Username: user1
Password: 
User root : login failed 2 time(s) successful 5 time(s).
Most recent Failure Thu Mar 19 2020 21:12:00 UTC
to con0_RP0_CPU0 from console
 
User user1 last logged in successfully Thu Mar 19 2020 21:11:50 UTC
to con0_RP0_CPU0 from console

process shutdown pam_manager

To disable platform automated monitoring (PAM) by shutting down the required process agents, use the process shutdown pam_manager command in XR EXEC mode.

process shutdown pam_manager [location {node-id | all}]

Syntax Description


location all	Disables PAM agents for all RPs.

Command Default

None

Command Modes

XR EXEC mode

Command History


Release	Modification
Release 6.1.2	This command was introduced.

Usage Guidelines

Because PAM tool process (pam_manager) is not a mandatory process, it does not restart automatically if it was manually disabled (unless in the case of a system reload). You can re-enable PAM using the process start pam_manager command.

If you use process shutdown pam_manager without any keywords, it disables PAM agents for the local RP.

Task ID


Task ID	Operation
network	read, write

Examples

This example shows how to disable PAM for all RPs:


RP/0/RP0/CPU0:router# process shutdown pam_manager location all

Related Commands

Command	Description
process start pam_manager	Re-enables platform automated monitoring (PAM) by restarting the required process agents.

process start pam_manager

To re-enable platform automated monitoring (PAM) by restarting the required process agents, use the process start pam_manager command in XR EXEC mode.

process start pam_manager [location {node-id | all}]

Syntax Description


location all	Restarts PAM agents for all RPs.

Command Default

None

Command Modes

XR EXEC mode

Command History


Release	Modification
Release 6.1.2	This command was introduced.

Usage Guidelines

If you use process start pam_manager without any keywords, it restarts PAM agents for the local RP.

You can use these commands to check if PAM is installed in the router:

show processes pam_manager location all (from Cisco IOS XR command line interface):
run ps auxw | egrep perl (from router shell prompt)

Task ID


Task ID	Operation
network	read, write

Examples

This example shows how to re-enable PAM for all RPs:


RP/0/RP0/CPU0:router# process start pam_manager location all

Related Commands

Command	Description
process shutdown pam_manager

service timestamps

To modify the time-stamp format for system logging (syslog) and debug messages, use the service timestamps command in XR Config mode. To revert to the default timestamp format, use the no form of this command.

service timestamps [ [debug | log] {datetime [localtime] [msec] [show-timezone] | disable | uptime}]

no service timestamps [ [debug | log] {datetime [localtime] [msec] [show-timezone] | disable | uptime}]

Syntax Description


debug	(Optional) Specifies the time-stamp format for debugging messages.
log	(Optional) Specifies the time-stamp format for syslog messages.
datetime	(Optional) Specifies that syslog messages are time-stamped with date and time.
localtime	(Optional) When used with the datetime keyword, includes the local time zone in time stamps.
msec	(Optional) When used with the datetime keyword, includes milliseconds in the time stamp.
show-timezone	(Optional) When used with the datetime keyword, includes time zone information in the time stamp.
disable	(Optional) Causes messages to be time-stamped in the default format.
uptime	(Optional) Specifies that syslog messages are time-stamped with the time that has elapsed since the networking device last rebooted.

Command Default

Messages are time-stamped in the month day hh:mm:ss by default.

The default for the service timestamps log datetime localtime and service timestamps debug datetime localtime forms of the command with no additional keywords is to format the time in the local time zone, without milliseconds and time zone information.

Command Modes

XR Config mode

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

Time stamps can be added to either debugging or syslog messages independently. The uptime keyword adds time stamps in the format hhhh:mm:ss, indicating the elapsed time in hours:minutes:seconds since the networking device last rebooted. The datetime keyword adds time stamps in the format mmm dd hh:mm:ss, indicating the date and time according to the system clock. If the system clock has not been set, the date and time are preceded by an asterisk (*), which indicates that the date and time have not been set and should be verified.

The no form of the service timestamps command causes messages to be time-stamped in the default format.

Entering the service timestamps form of this command without any keywords or arguments is equivalent to issuing the service timestamps debug uptime form of this command.

Task ID


Task ID	Operations
logging	read, write

Examples

This example shows how to enable time stamps on debugging messages, which show the elapsed time since the networking device last rebooted:


RP/0/RP0/CPU0:router(config)# service timestamps debug uptime

This example shows how to enable time stamps on syslog messages, which show the current time and date relative to the local time zone, with the time zone name included:


RP/0/RP0/CPU0:router(config)# service timestamps log datetime localtime show-timezone

show logging

To display the contents of the logging buffer, use the show logging command in XR EXEC mode.

show logging [ [alarm-location location location] | | [correlator options] | local location node-id | [location node-id] [start month day hh : mm : ss] [process name] [string string] [end month day hh : mm : ss] [events options] [history] [last entries] [suppress rule {rule_name | all}]]

Syntax Description


alarm-location trace `location`	(Optional) Displays the alarm-location information. The trace option shows trace data for the alarm location components.
correlator`options`	(Optional) Displays the content and information about correlation buffer. The various options available are: buffer: Displays the content of the correlation buffer. info: Displays information about event correlation. trace: Displays trace data for the alarm_logger component.
end `month` `day` `hh` : `mm` : `ss`	(Optional) Displays syslog messages with a time stamp equal to or lower than the time stamp specified with the `monthday` `hh` : `mm` : `ss` argument. The ranges for the `month` `day` `hh` : `mm` : `ss` arguments are as follows: `month` —The month of the year. The values for the `month` argument are: january february march april may june july august september october november december `day` —Day of the month. Range is 01 to 31. `hh` : —Hours. Range is 00 to 23. You must insert a colon after the `hh` argument. `mm` : —Minutes. Range is 00 to 59. You must insert a colon after the `mm` argument. `ss` —Seconds. Range is 00 to 59.
events `options`	Displays the content and information about event buffer.The various options available are: buffer: Displays the content of the event buffer. info: Displays information about events buffer. rule: Displays specified rules. ruleset: Displays rulesets. trace: Displays trace data for the correlation component.
history	Displays the contents of logging history.
last `entries`	Displays last <n> entries. The number of entries can range from 1 to 500.
local location `node-id`	(Optional) Displays system logging (syslog) messages from the specified local buffer. The `node-id` argument is entered in the `rack/slot/modul` e notation.
location `node-id`	(Optional) Displays syslog messages from the designated node. The `node-id` argument is entered in the `rack/slot/modul` e notation.
start `month` `day` `hh` : `mm` : `ss`	(Optional) Displays syslog messages with a time stamp equal to or higher than the time stamp specified with the `month` `day` `mm` : `hh` : `ss` argument. The ranges for the `month` `day` `hh` : `mm` : `ss` arguments are as follows: `month` —The month of the year. The values for the `month` argument are: january february march april may june july august september october november december `day` —Day of the month. Range is 01 to 31. `hh` : —Hours. Range is 00 to 23. You must insert a colon after the `hh` argument. `mm` : —Minutes. Range is 00 to 59. You must insert a colon after the `mm` argument. `ss` —Seconds. Range is 00 to 59.
process `name`	(Optional) Displays syslog messages related to the specified process.
string `string`	(Optional) Displays syslog messages that contain the specified string.
suppress rule{`rule_name`\|all}	Displays the content and information about log suppression. The rule option shows specified rules.

Command Default

None

Command Modes

XR EXEC mode

Command History


Release	Modification
Release 6.0	This command was introduced.

Usage Guidelines

Use the show logging command to display the state of syslog error and event logging on the processor console. The information from the command includes the types of logging enabled and the size of the buffer.

Task ID


Task ID	Operations
logging	read

Examples

This is the sample output from the show logging command with the process keyword and name argument. Syslog messages related to the init process are displayed in the sample output.


RP/0/RP0/CPU0:router# show logging process init

Syslog logging: enabled (24 messages dropped, 0 flushes, 0 overruns)
Console logging: level, 59 messages logged
Monitor logging: level debugging, 0 messages logged
Trap logging: level informational, 0 messages logged
Buffer logging: level debugging, 75 messages logged

Log Buffer (16384 bytes):

LC/0/1/CPU0:May 24 22:20:13.043 : init[65540]: %INIT-7-INSTALL_READY : total time 47.522 seconds 
SP/0/1/SP:May 24 22:18:54.925 : init[65541]: %INIT-7-MBI_STARTED : total time 7.159 seconds 
SP/0/1/SP:May 24 22:20:16.737 : init[65541]: %INIT-7-INSTALL_READY : total time 88.984 seconds 
SP/0/SM1/SP:May 24 22:18:40.993 : init[65541]: %INIT-7-MBI_STARTED : total time 7.194 seconds 
SP/0/SM1/SP:May 24 22:20:17.195 : init[65541]: %INIT-7-INSTALL_READY : total time 103.415 seconds 
SP/0/2/SP:May 24 22:18:55.946 : init[65541]: %INIT-7-MBI_STARTED : total time 7.152 seconds 
SP/0/2/SP:May 24 22:20:18.252 : init[65541]: %INIT-7-INSTALL_READY : total time 89.473 seconds

This is the sample output from the show logging command using both the processname keyword argument pair and location node-id keyword argument pair. Syslog messages related to the “init” process emitted from node 0/RP0/CPU0 are displayed in the sample output.


RP/0/RP0/CPU0:router# show logging process init location 0/RP0/CPU0

Syslog logging: enabled (24 messages dropped, 0 flushes, 0 overruns)
Console logging: level, 59 messages logged
Monitor logging: level debugging, 0 messages logged
Trap logging: level informational, 0 messages logged
Buffer logging: level debugging, 75 messages logged

Log Buffer (16384 bytes):
LC/0/1/CPU0:May 24 22:20:13.043 : init[65540]: %INIT-7-INSTALL_READY : total time 47.522 seconds

This table describes the significant fields shown in the display.

Table 5. show logging Field Descriptions
Field	Description
Syslog logging	If enabled, system logging messages are sent to a UNIX host that acts as a syslog server; that is, the host captures and saves the messages.
Console logging	If enabled, the level and the number of messages logged to the console are stated; otherwise, this field displays “disabled.”
Monitor logging	If enabled, the minimum level of severity required for a log message to be sent to the monitor terminal (not the console) and the number of messages logged to the monitor terminal are stated; otherwise, this field displays “disabled.”
Trap logging	If enabled, the minimum level of severity required for a log message to be sent to the syslog server and the number of messages logged to the syslog server are stated; otherwise, this field displays “disabled.”
Buffer logging	If enabled, the level and the number of messages logged to the buffer are stated; otherwise, this field displays “disabled.”

enable-pam process-monitoring

To detect the blocked processes on all nodes in the system, use the enable-pam process-monitoring command in EXEC mode to enable the Platform Automated Monitoring process blockage monitoring feature.

Syntax Description

This command has no keywords or arguments.

Command Default

None

Command Modes

EXEC mode

Command History


Release	Modification
Release 7.5.2	This command was introduced.

Usage Guidelines

This command generates tech-support information that is useful for Cisco Technical Support representatives when troubleshooting a router. When PAM detects a process crash, traceback, potential memory leak, CPU hog, a full file system or blocked process on any node, it automatically collects logs and saves these logs (along with the core file in applicable cases) as a .tgz file in harddisk:/cisco_support/ or in /misc/disk1/cisco_support/ directory. PAM also generates a system log message with severity level as warning, mentioning the respective issue.

For Cisco Technical Support contact information, see the 'Obtaining Documentation and Submitting a Service Request' section in the Preface.

Task ID


Task ID	Operations
monitor	read
basic-services or cisco-support	read

Examples

Router# enable-pam process-monitoring
PAM "Monitoring Process Blockage" Feature is enabled

disable-pam process-monitoring

To disable the Platform Automated Monitoring process blockage monitoring feature, use the disable-pam process-monitoring command in EXEC mode. To re-enable the feature, use the enable form of this command.

Syntax Description

This command has no keywords or arguments.

Command Default

None

Command Modes

EXEC mode

Command History


Release	Modification
Release 7.5.2	This command was introduced.

Usage Guidelines

This command generates tech-support information that is useful for Cisco Technical Support representatives when troubleshooting a router. When PAM detects a process crash, traceback, potential memory leak, CPU hog, a full file system or blocked process on any node, it automatically collects logs and saves these logs (along with the core file in applicable cases) as a .tgz file in harddisk:/cisco_support/ or in /misc/disk1/cisco_support/ directory. PAM also generates a system log message with severity level as warning, mentioning the respective issue.

For Cisco Technical Support contact information, see the 'Obtaining Documentation and Submitting a Service Request' section in the Preface.

Task ID


Task ID	Operations
monitor	read
basic-services or cisco-support	read

Examples

Router# disable-pam process-monitoring
PAM "Monitoring Process Blockage" Feature has been disabled

show pam process-monitoring-status

To see if the Platform Automated Monitoring (PAM) process blockage monitoring is enabled or disabled, use the show pam process-monitoring-status command in EXEC mode.

Syntax Description

This command has no keywords or arguments.

Command Default

None

Command Modes

EXEC mode

Command History


Release	Modification
Release 7.5.2	This command was introduced.

Usage Guidelines

This command generates tech-support information that is useful for Cisco Technical Support representatives when troubleshooting a router. When PAM detects a process crash, traceback, potential memory leak, CPU hog, a full file system or blocked process on any node, it automatically collects logs and saves these logs (along with the core file in applicable cases) as a .tgz file in harddisk:/cisco_support/ or in /misc/disk1/cisco_support/ directory. PAM also generates a system log message with severity level as warning, mentioning the respective issue.

For Cisco Technical Support contact information, see the 'Obtaining Documentation and Submitting a Service Request' section in the Preface.

Task ID


Task ID	Operations
monitor	read
basic-services or cisco-support	read

Examples

Router# show pam process-monitoring-status
PAM "Monitoring Process Blockage" Feature is disabled

Bias-Free Language

Results

Chapter: Logging Services Commands

Logging Services Commands

archive-length

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Task ID

Examples

archive-size

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Task ID

Examples

clear logging

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Task ID

Examples

device

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Task ID

Examples

file-size

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Task ID

Examples

logging

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Examples

Configuration Example for Facility and Source-address Per Remote Syslog Server

logging archive

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Task ID

Examples

logging buffered

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Task ID

Examples

logging console

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Task ID

Examples

logging console disable

Syntax Description

Command Default