Filter
Top Products
Duplicate Logging
If a facility value is repeated in
syslog.conf
, for example:
user.debug /tmp/syslog_user_debug
user.alert /tmp/syslog_user_alert
The syslog daemon will log
user.debug
messages only to the
/tmp/syslog_user_debug
file while user.alert messages will be logged to both the
/tmp/syslog_user_debug
file and the
/tmp/syslog_user_alert
file. This is consistent
with the syslog design that logs the more severe conditions in multiple places.
To prevent this duplicate logging, it is recommended that different facility values be
specified in the
syslog.conf
file. A total of 19 facility values are available.
Recurring Sequence Numbers in Syslog Output Files
Depending upon the configuration of your network, it is possible for duplicate UDP
packets containing ELS messages to arrive at the remote host. It is also possible
for the packets to arrive in a different order than they were transmitted. An example
of this phenomenon is shown in Figure 13. Notice that the messages with sequence
numbers 628 through 633 are logged twice. Also notice that after the first
occurrence of sequence number 0630, sequence number 0629 occurs again,
followed by the second occurrence of 0630.
Because neither Syslog nor UDP has the ability to handle duplicate or out of
sequence packets, it is important to recognize the possibility of duplicate sequence
numbers occurring.
Using ELS Message Buffering
Message buffering is an advanced feature of ELS that can help you with problem
determination. You can set up defaults that ELS will use for message buffering or
change how messages are buffered while the router is operating. Message buffering
can minimize the information lost because messages have wrapped in the default
message buffers. Message buffering is accessible through the advanced
configuration or monitoring command. It enables you to:
v Specify whether buffering is active.
v Specify what events are written to the message buffer.
v Stop buffering and free the memory allocated for buffering.
v Display the status of the message buffer.
Apr 01 10:48:33 0.0.0.0 Msg [0628] from: RA22: : els: IPX.018: SAP gen rply sent nt 5 int TKR/1, 1 pkts
Apr 01 10:48:33 0.0.0.0 Msg [0628] from: RA22: : els: IPX.018: SAP gen rply sent nt 5 int TKR/1, 1 pkts
Apr 01 10:49:08 0.0.0.0 Msg [0629] from: RA22: : els: IPX.037: RIP resp sent nt 0 int TKR/0, 1 pkts
Apr 01 10:49:08 0.0.0.0 Msg [0630] from: RA22: : els: IPX.018: SAP gen rply sent nt 0 int TKR/0, 1 pkts
Apr 01 10:49:08 0.0.0.0 Msg [0629] from: RA22: : els: IPX.037: RIP resp sent nt 0 int TKR/0, 1 pkts
Apr 01 10:49:08 0.0.0.0 Msg [0630] from: RA22: : els: IPX.018: SAP gen rply sent nt 0 int TKR/0, 1 pkts
Apr 01 10:49:33 0.0.0.0 Msg [0631] from: RA22: : els: IPX.037: RIP resp sent nt 5 int TKR/1, 1 pkts
Apr 01 10:49:33 0.0.0.0 Msg [0631] from: RA22: : els: IPX.037: RIP resp sent nt 5 int TKR/1, 1 pkts
Apr 01 10:49:33 0.0.0.0 Msg [0632] from: RA22: : els: IPX.018: SAP gen rply sent nt 5 int TKR/1, 1 pkts
Apr 01 10:49:33 0.0.0.0 Msg [0632] from: RA22: : els: IPX.018: SAP gen rply sent nt 5 int TKR/1, 1 pkts
Apr 01 10:50:08 0.0.0.0 Msg [0633] from: RA22: : els: IPX.037: RIP resp sent nt 0 int TKR/0, 1 pkts
Apr 01 10:50:08 0.0.0.0 Msg [0633] from: RA22: : els: IPX.037: RIP resp sent nt 0 int TKR/0, 1 pkts
Figure 13. Example of Recurring Sequence Numbers in Syslog Output
Using ELS
Chapter 12. Using the Event Logging System (ELS) 163
|
|
|
|
|
|
|
|
|
|
|
|
|