Error Message Logging and Limiting the Display of Error Messages
Logging messages are important sources of information for network engineers in charge of troubleshooting. This section covers the following topics:
- The options for the logging messages destination
- Which destinations are the default for logging messages
- Which commands enable/disable different destinations
- How usage of different logging destinations compares with regard to the overhead they introduce on the routers
- The eight levels of logging
- Deciphering the logging messages
Message logging is enabled by default and it is directed to the console and the internal buffer. The privileged exec command logging on is the default setting, and if you enter no logging on, all logging except console logging will be turned off. The options for logging message destinations are:
- Console
- Internal buffer
- Virtual terminal session (Telnet)
- Syslog server (see Figure 4-5)
){kind=link}
Figure 4-5 Error Message Logging Destinations
The following relationship demonstrates how different methods of logging compare in terms of the overhead they produce:
Buffered logging < Syslog < Virtual terminal < Console logging
Table 4-1 displays the commands you must use to configure the destination of logging messages and the desired level of logging for each destination.
Table 4-1 List of Commands for Logging Message Destinations
|
Command |
Usage Explanation |
|
logging console [level] |
This command turns console logging on and specifies the level of logging to be directed to the console. (The default setting is Enabled.) The no logging console command disables console logging. |
|
logging buffered [level] |
Use this command to enable sending logging messages to the internal buffer (use no logging buffered to disable it) and specify the level of logging desired to be buffered. This feature is enabled by default. |
|
logging monitor [level] |
Use this command to enable sending logging messages to the virtual terminal sessions (use no logging monitor to disable it) and specify the level of logging desired to be directed to the virtual terminal lines. From within a virtual terminal session, typing the command terminal monitor enables the display of logging messages. The command terminal no monitor turns this feature off. |
|
logging trap [level] |
This command allows you to enable sending logging messages to syslog servers and specify the level of these messages. The no logging trap command disables this feature. The default level is Informational. (Also see the explanation for the logging [ip-address] command below.) |
|
logging [ip-address] |
This command identifies the IP address of the syslog server so that the router can direct its logging messages to this address. Ifyou have a list of syslog servers to which you want to send the logging messages, you may enter this command with each server's appropriate address one by one. Use the no form of this command to take a server off the list. |
There are eight levels of logging. If you specify a particular level of logging—for console logging, for example—the messages of that level and of the higher levels (numerically lower) are forwarded to the console. The levels of logging messages are explained in Table 4-2.
Table 4-2 Logging Messages
|
Level |
Logging Message |
|
0 |
Emergencies |
|
1 |
Alerts |
|
2 |
Critical |
|
3 |
Errors |
|
4 |
Warnings |
|
5 |
Notifications |
|
6 |
Informational |
|
7 |
Debugging |
Please note that when you enter one of the commands for specifying the level of logging to be directed to a particular place (console or virtual terminal sessions, for example), you must enter the English phrase for the level of logging and not the numeric value for it. For instance, the command to make virtual terminal lines receive logging messages at the errors level and higher (in other words errors, critical, alerts, emergencies) would be:
Router(config)# logging monitor error
Now let us discuss the anatomy of the logging messages. Each message is associated with one of the eight levels of logging, which is referred to as the severity of the message. Table 4-3 provides the eight levels of logging messages along with their associated severity levels and short descriptions. Logging messages are composed of a % sign followed by the facility, the severity, the mnemonic, and a text message. For instance, in this message:
%TR-3-WIREFAULT:Unit[0],wirefault:check the lobe cable MAU connection
the facility is Token Ring, severity is 3 (error), mnemonic is WIREFAULT, and, of course, the text message is reporting a wire fault condition.
Table 4-3 Logging Message Levels with Severity
|
Level Name |
Severity |
Description |
Syslog Definition |
|
Emergencies |
0 |
System unusable |
LOG_EMERG |
|
Alerts |
1 |
Immediate action needed |
LOG_ALERT |
|
Critical |
2 |
Critical conditions |
LOG_CRIT |
|
Errors |
3 |
Error conditions |
LOG_ERR |
|
Warnings |
4 |
Warning conditions |
LOG_WARNING |
|
Notifications |
5 |
Normal significant conditions |
LOG_NOTICE |
|
Informational |
6 |
Informational messages only |
LOG_INFO |
|
Debugging |
7 |
Debugging messages |
LOG_DEBUG |
show logging Command
To display the state of syslog error and event logging, including host addresses, which type of logging (destination) is enabled, and other logging statistics, use the show logging (privileged EXEC) command. This command also displays the messages that are logged in the buffer.
Example 4-2 displays sample output of the show logging command.
Example 4-2 The show logging Command
|
Router#show logging |
|
Syslog logging: enabled |
|
Console logging: disabled |
|
Monitor logging: level debugging, 13 messages logged. |
|
Trap logging: level informational, 13 messages logged. |
|
Logging to 171.16.20.20 |
|
SNMP logging: enabled, retransmission after 30 seconds |
|
69 messages logged |
|
Logging to 10.1.1.30, 0/10 |
|
Logging to 10.2.1.40, 0/10 |
|
Logging to 10.3.2.50, 0/10 |