Cisco Switching/Routing :: Way To Get More Messages Out Of 2950 Set To Syslog
Feb 11, 2012
Is there a way to get more messages out of a 2950 set to syslog? I've turned every logging option I can find to DEBUG, but all I get in my syslog are LinkUp/Down messages and "Configured from console by console". I'd love to see more information such as configuration changes, or even someone attempting to set up DTP on a switchport set to access mode.
View 2 Replies
ADVERTISEMENT
Jun 12, 2012
Is there any way to change the port that is used for syslog messages on a Cisco 9500 switch?By default this is set to UDP port 514.There doesn't seem to be a command to change the port.
View 1 Replies
View Related
Jul 2, 2012
Query is, Can i send my syslog messages to SNMP sever? if so, what command needs to be enabled on nexus 7k?
View 3 Replies
View Related
Aug 15, 2011
I m getting below error messages in show logs -
Aug 12 15:30:57.127 IST: %ENVIRONMENT-3-RPS_FAILED: Faulty internal power supply detected
Aug 12 15:31:02.175 IST: %ENVIRONMENT-3-RPS_FAILED: Faulty internal power supply detected
Aug 12 15:31:08.219 IST: %ENVIRONMENT-3-RPS_FAILED: Faulty internal power supply detected
Aug 12 15:31:10.239 IST: %ENVIRONMENT-3-RPS_FAILED: Faulty internal power supply detected
there is no error messages related to PSU in "show env all " log .
here is show version -
------------------ show version ------------------
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6K2L2Q4-M), Version 12.1(22)EA13, RELEASE SOFTWARE (fc2)
Technical Support: [URL]
Copyright (c) 1986-2009 by cisco Systems, Inc.
[Code] ....
View 8 Replies
View Related
Dec 15, 2012
I am using Solawinds syslog and trying to get our Cisco routers send syslogs to our syslog server. I followed the procedure on Configuring Cisco Devices to Use a Syslog Server from [URL] Our Cisco swtches are all sending syslog messages but not the routers. I compared the config with our access switches but can't seem to find the problem:
Sample router config:
service nagleno service padservice tcp-keepalives-inservice tcp-keepalives-outservice timestamps debug datetime msec localtime show-timezoneservice timestamps log datetime msec localtime show-timezoneservice password-encryption!hostname WWF-RT1boot-start-markerboot-end-marker!security authentication failure rate 10 logsecurity passwords min-length 8logging buffered 4096logging rate-limit all 10logging console critical!aaa new-model!!
[Code] .......
is there a command that prevents the router from sending the syslog to the server?
View 2 Replies
View Related
Jul 26, 2012
I'm getting the Syslog messages frequently on daily basis.
View 4 Replies
View Related
Mar 12, 2012
I have a new install of LMS 4.2 on a virtual appliance. No syslog messages are getting into LMS. They are being received by the server, but are showing up in /var/adm/CSCOpx/log/dmgtd.log, and aren't getting processed by SyslogAnalyser.
View 3 Replies
View Related
Sep 28, 2011
LMS 4.1 is not showing any valid syslog messages, only invalid messages. Is there anything different in 4.1 that needs to be set?
View 2 Replies
View Related
Jun 19, 2012
My Cisco devices send syslog messages to LMS but it wont`t show any messages from device. Older LMS 3.2 and other collector showe all syslog messages. What to do with LMS 4.0.1?
View 2 Replies
View Related
Mar 3, 2013
I have a newly installed LMS 4.1 that had the Syslog feature working for a while.
Recently, the Syslog is no longer displaying any records (neither new or old messages).
Below are the steps I have tried to troubleshoot the problem:
- Installed wireshark : Syslog messages are being received by the LMS server on time
- In the Syslog.log file, I can see that all the Syslog messages are being logged properly
- I tried to disable all the "Syslog Message Filters" but nothing changed
In the SyslogCollector.log, I can find the below logs:
NMSROOT is C:/PROGRA~2/CSCOpx
propFileC:/PROGRA~2/CSCOpxMDC omcatwebapps
meWEB-INFclassesC:PROGRA~2CSCOpxMDC omcatwebapps
[Code]....
View 0 Replies
View Related
Aug 22, 2011
I have a small problem with a lot of invalid syslog messages in LMS 3.2. Something about 30% of all messages are invalid.
Is there any posibility to get out from which devices those messages are?
Is it a big problem for the application if there are such a lot of invalid messages? I have a lot of devices in my LMS and don't want to get high load because of such unneeded messages.
View 1 Replies
View Related
Jun 26, 2012
Is there a way to debug syslog messages? Something like "debug ip syslog"?
View 11 Replies
View Related
Mar 6, 2012
I bought a RV110W wireless router a couple months ago that I've been pretty happy with.
However, I have one significant problem with it. It is configured to send syslog messages to an internal server. Twice now it has gone into a mode where it starts dumping messages like,
ip_conntrack_is_ipc_allowed: ipc_entry_is_full
continuously, at a rate of about 20 per second. It otherwise seems to function normally, but of course if unnoticed my syslog file quickly grows to hundreds or thousands of megabytes. A reboot restores normal operation. It is running firmware 1.1.0.9. A search on the internet turned up no information about this problem.
It may be some corruption is occuring in the router's OS, or perhaps this is something that can be triggered externally (in which case it would be a weak form of DoS attack? Or maybe worse if in this state it is unable to properly apply the firewall rules.)
View 2 Replies
View Related
May 19, 2010
I want to use IP SLA to perform simple up/down monitoring of an IP host and to generate a syslog alert if the host goes down. I have a 2650XM router running 12.4(23) IP Voice IOS. My basic IP SLA config is hown below:
ip sla monitor 10
type echo protocol ipIcmpEcho 10.55.1.1
timeout 1000
frequency 10
ip sla monitor schedule 10 life forever start-time now.
View 7 Replies
View Related
May 10, 2012
We started getting the below syslog messages from one of our ASA5520 which was recently upgraded to 8.4(2). Any bugs on 8.4(2) that cause this or its simply the RAM failure?
%ASA-3-105010: (Primary) Failover message block alloc failed
%ASA-3-321007: System is low on free memory blocks of size 1550 (0 CNT out of 18709 MAX)
View 2 Replies
View Related
Dec 4, 2011
how can I configure ACS 5.2 to send syslog messages to CS-MARS?
View 3 Replies
View Related
May 7, 2013
I'm building the use case to test / detect for rogue devices on the network. I have in my enviroment Lan controller 5500 controller with AP (aironet 3500). I want to detect for rogue devices/ap connected to my network. I know before i can see this activity on the network i have to configure the controller / ap to detect this behavior. I'm doing this step.
Authorize AP's against AAA function to make sure that all the AP's registering to your WLC are authorized AP's of the network.By enabling this feature, only those AP's whose mac-addresses are present in the authorization list, will be able to register to the URL
Using Rogue detection. feature, the WLC will be able to detect any AP that is not a part of its RF group and contain it.URL
NOTE: from the forum I have seen other talks about the same issue and saying that if I have any APs in "Rogue Detection" mode sitting on the trunk port on the switch then only, this AP will detect the Rogue on Wired
I don't think i completely understand this statement, by sitting does it mean that it is passively sniffing coming in/out on trunk link?
Considering the above steps are accurate, after this will i be able to see rogue detection behavior in syslogs? What exactly would be the messages that would produce this behavior.
View 7 Replies
View Related
Mar 27, 2012
I have an issue with the syslog of 7600 router, I have configured the logging level to informational, but when I execute changes such as up or down an interface, the syslog messages aren't displayed? Why is the reason? This symptom exist after I changed the buffer size from default to 32768.
Router#sh log
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 2 flushes, 0 overruns, xml disabled, filtering disabled)
No Active Message Discriminator.
No Inactive Message Discriminator.
Console logging: disabled
Monitor logging: level debugging, 40 messages logged, xml disabled,
[code]....
View 4 Replies
View Related
May 9, 2013
I'm building the use case to test / detect for rogue devices on the network. I have in my enviroment Lan controller 5500 controller with AP (aironet 3500). I want to detect for rogue devices/ap connected to my network. I know before i can see this activity on the network i have to configure the controller / ap to detect this behavior.
Authorize AP's against AAA function to make sure that all the AP's registering to your WLC are authorized AP's of the network.By enabling this feature, only those AP's whose mac-addresses are present in the authorization list, will be able to register to the WLC. url...
Using Rogue detection. feature, the WLC will be able to detect any AP that is not a part of its RF group and contain it. url...the forum I have seen other talks about the same issue and saying that if I have any APs in "Rogue Detection" mode sitting on the trunk port on the switch then only, this AP will detect the Rogue on Wired.
View 2 Replies
View Related
Mar 27, 2012
I've got a 48-port 3750 running 12.2(46)SE and I am seeing these messages in the logs. Has any seen this message before or what it means ?
Invalid packet (too large) length=22320
View 1 Replies
View Related
Feb 28, 2012
I have a new redundant network with two cores C1 and C2 and five access switches A1 to A5. They are all Cisco SG300 switches. I have noticed there are too many STP messages emanating from one host which has a MAC address which cannot be traced on the network. In the redundant network, I made C1 the root bridge by giving it a priority of 4096 and C2 has been given a priority of 8192 so that it is the secondary root bridge in the network. I have left all other STP settings to default on the rest of the switches in the network.
The problem is that one host is advertising a RST root bridge all the time. Now it has a mac address which is different from the mac address of the root bridge itself and i cannot trace this mac address on the network. Look at the snapshot of Wireshark output in the attach.The source MAC address which is the host advertising all the time is 1c:df:0f:34:db and the root bridge is 1c:df:0f:bb:34:c4.
Why would the root bridge be resetted all the time?I've also noticed that one port in a LAG configuration on one of the access switches is flapping up and down all the time.I tried to troubleshoot this problem. It is not the cable. It would be something else. What could cause this flapping of the port?Could it be related to STP?
On the other Core switch C2 I can see a LAG status switching between forwarding and blocking all the time. What could make the LAG status to flap from forwarding to blocking and back all the time like this?
View 3 Replies
View Related
Dec 16, 2012
Is there a way to turn off 802.1x authentication messages to the console of a 3750 switch? The issue we have is that we like to monitor the terminal when remotely configuring our switches. However, every time a computer authenticates to the network we get messages and sometimes quite a few depending on the situation.
View 3 Replies
View Related
Dec 26, 2010
I had these error messages on both my Cisco 2851 and on my Cisco Catalyst 6506.
On Cisco 2851:
%SYS-SP-3-CPUHOG: Task is running for (2000)msecs, more than (2000)msecs (4/4),process = SEA write CF process. [code]...
And on 6506:
Dec 27 15:20:55 MET: %SYS-SP-3-CPUHOG: Task is running for (2000)msecs, more than (2000)msecs (129/129),process = SEA write CF process.[ code]...
I have these IOS versions on my Cisco:
Cisco 2851: 15.0(1)M4
Cisco 6506: 12.2(33)SXI
View 3 Replies
View Related
Jan 24, 2012
While working at a client site today, I was troubleshooting some ICMP connectivity for a network we have created.I turned on 'debug ip icmp" on the 3550 switch int he middle, and was inundated with the following debug output:
Jan 25 11:01:14.641: ICMP: dst (172.16.1.7) port unreachable rcv from 172.16.1.5
Jan 25 11:01:14.641: ICMP: dst (172.16.1.7) port unreachable rcv from 172.16.1.5
Jan 25 11:01:14.641: ICMP: dst (172.16.1.7) port unreachable rcv from 172.16.1.5
Jan 25 11:01:14.641: ICMP: dst (172.16.1.7) port unreachable rcv from 172.16.1.5
[code]....
This output fires several times a second, and based on how often it is firing, I am curious if it may be a culprit with respect to the fact that the client has indicated that they have some slow internet.Should the next step be to look at the workstation at 172.16.1.5?
View 10 Replies
View Related
Sep 30, 2012
We use C2950G switches with IOS 12.1(22)EA12 . Switches are set up to send logs to a server (informationnal level). On this server, we receive many of logs from those switches, but none about interfaces errors (even if interfaces statistics show interfaces errors). On C3548 switches it's work fine.How should I be sure the set up of switches is correct ? Why do I never receive messages as %LINK-4-ERROR:[char] is experiencing errors ?
View 2 Replies
View Related
Feb 12, 2013
Setting up NTP. Currently the source for NTP within our network is our core 6500.Currently the NTP source for the 6500 are internet based NTP Servers. I would like to configure the 6500 to respond to NTP messages as the NTP Master. However will the 6500's source remain as the internet based NTP Servers?? In other words if the 6500is configured to be NTP Master, where would it get it's time from?
View 5 Replies
View Related
May 9, 2012
I have a situation in which I want to log a specific message (informational - 6 level), but don't want to enable informational logging and get all the messages that come with it. Is there a feature in IOS, 3560 12.2(25r)SEE4, similar to the 'logging lists' feature on the ASA that allows you to specify logs that you want to capture without having to change your logging level? I didn't want to have to write an EEM applet for this, but if that's the only way, I'd consider it.
View 3 Replies
View Related
Dec 26, 2012
I am getting the below messages on my Cisco 6500 series switches every 1min. The IOS version is 12.2(33)SXI6 & with SUP32-GE-3B
%ILPOWER-7-DETECT: Interface Fa1/1: Power Device detected: Cisco PD
%ILPOWER-7-DETECT: Interface Fa1/1: Power Device detected: Cisco PD
%ILPOWER-7-DETECT: Interface Fa1/1: Power Device detected: Cisco PD
These messages are I am recieving on few ports only not on all port having IP Phone connected. I tried changing the phone to some other model but that also did not resolved my problem. Also I tried powering on the phone using power adapter but the issue still persist.
Client are not facing any issues due to this error, but still I would like know what can be the issue which is generating these logs.
View 1 Replies
View Related
Dec 9, 2012
We have recently upgraded oor LAN and we are using couple of Nexus5548UP switches in the core with 2960 stacks as access switches. Each access switches stack is connnected to both core switches with link being port-chanels and VPCs. All is working fine, but our SolarWinds management platform (NPM) is being flooded with "Physical Address changed" events. Here is an example of messages:
NSW_Core_2 - Ethernet1/7 Physical Address changed from 000000003811 to 73616D653811
NSW_Core_2 - Ethernet1/7 Physical Address changed from 200B82B43811 to 000000003811
For each interface I have messages like these repeating.I am not sure what those messages means or if there is actually anything wrong. Performance of the network is good, there are no errors on any interfaces and I do not see anything related in the switch loggs.
View 4 Replies
View Related
Jan 14, 2012
I am using radius authentication on C4507R+E with supervisor card 6L-E and IOS 15.0.2(SG1). It works perfectly but all radius messages appear in the console. Radius is very verbose, I can't use console because of the significant number of messages and I am worried about switches performances. I add that all debug commands are disabled.
View 1 Replies
View Related
Mar 30, 2013
how to enable snmp traps for syslog message in Cisco Nexus platform ?
Mean what would be equivalent CLI for the below
"snmp-server enable traps syslog"
View 2 Replies
View Related
Oct 22, 2011
I have a couple of Cisco 2960's sending syslog messages to a remote syslog-ng on port 514 (standard).
I need to set another Swtich so it sends traffic to the same syslog server but on another UDP port (such as 714),, is that possible,? I cannot find the option on the documentation.
View 9 Replies
View Related
Oct 3, 2012
I have enabled syslog on my Cisco 2960S swtich as shown below -
-logging facility local6
-logging host 10.11.12.122 transport tcp port 514
I have sent the port to TCP since that is what is configured on the SYSLOG server which is a CENTOS 5.8, running rsyslogd.I have tested the rsyslogd locally and it work.However i want to send any and all log messages in the buffer to my syslog server and it is not working.there is no firewall on the CENTOS and the ASA firewall filter is enabled for outgoing traffic.
View 5 Replies
View Related