IBM SC30-3681-08 manual Using ELS Message Buffering, Duplicate Logging

Using ELS

Duplicate Logging

If a facility value is repeated in syslog.conf, for example:

user.debug	/tmp/syslog_user_debug
user.alert	/tmp/syslog_user_alert
The syslog daemon will log user.debug messages only to the
/tmp/syslog_user_debug ®le while user.alert messages will be logged to both the
/tmp/syslog_user_debug ®le and the/tmp/syslog_user_alert ®le. This is consistent
with the syslog design that logs the more severe conditions in multiple places.
To prevent this duplicate logging, it is recommended that different facility values be
speci®ed in thesyslog.conf ®le. A total of 19 facility values are available.
Recurring Sequence Numbers in Syslog Output Files
Depending upon the con®guration of your network, it is possible for duplicate UDP
packets containing ELS messages to arrive at the remote host. It is also possible
for the packets to arrive in a different order than they were transmitted. An example
of this phenomenon is shown in Figure 13. Notice that the messages with sequence
numbers 628 through 633 are logged twice. Also notice that after the ®rst
occurrence of sequence number 0630, sequence number 0629 occurs again,
followed by the second occurrence of 0630.
Apr 01 10:48:33 0.0.0.0 Msg [0628] from: RA22: : els: IPX.018: SAP gen rply sent nt 5 int TKR/1, 1 pkts
Apr 01 10:48:33 0.0.0.0 Msg [0628] from: RA22: : els: IPX.018: SAP gen rply sent nt 5 int TKR/1, 1 pkts
Apr 01 10:49:08 0.0.0.0 Msg [0629] from: RA22: : els: IPX.037: RIP resp sent nt 0 int TKR/0, 1 pkts
Apr 01 10:49:08 0.0.0.0 Msg [0630] from: RA22: : els: IPX.018: SAP gen rply sent nt 0 int TKR/0, 1 pkts
Apr 01 10:49:08 0.0.0.0 Msg [0629] from: RA22: : els: IPX.037: RIP resp sent nt 0 int TKR/0, 1 pkts
Apr 01 10:49:08 0.0.0.0 Msg [0630] from: RA22: : els: IPX.018: SAP gen rply sent nt 0 int TKR/0, 1 pkts
Apr 01 10:49:33 0.0.0.0 Msg [0631] from: RA22: : els: IPX.037: RIP resp sent nt 5 int TKR/1, 1 pkts
Apr 01 10:49:33 0.0.0.0 Msg [0631] from: RA22: : els: IPX.037: RIP resp sent nt 5 int TKR/1, 1 pkts
Apr 01 10:49:33 0.0.0.0 Msg [0632] from: RA22: : els: IPX.018: SAP gen rply sent nt 5 int TKR/1, 1 pkts
Apr 01 10:49:33 0.0.0.0 Msg [0632] from: RA22: : els: IPX.018: SAP gen rply sent nt 5 int TKR/1, 1 pkts
Apr 01 10:50:08 0.0.0.0 Msg [0633] from: RA22: : els: IPX.037: RIP resp sent nt 0 int TKR/0, 1 pkts
Apr 01 10:50:08 0.0.0.0 Msg [0633] from: RA22: : els: IPX.037: RIP resp sent nt 0 int TKR/0, 1 pkts
Figure 13. Example of Recurring Sequence Numbers in Syslog Output
Because neither Syslog nor UDP has the ability to handle duplicate or out of
sequence packets, it is important to recognize the possibility of duplicate sequence
numbers occurring.
Using ELS Message Buffering
Message buffering is an advanced feature of ELS that can help you with problem
determination. You can set up defaults that ELS will use for message buffering or
change how messages are buffered while the router is operating. Message buffering
can minimize the information lost because messages have wrapped in the default
message buffers. Message buffering is accessible through the advanced
con®guration or monitoring command. It enables you to:
v Specify whether buffering is active.
v Specify what events are written to the message buffer.
v Stop buffering and free the memory allocated for buffering.
v Display the status of the message buffer.

Chapter 12. Using the Event Logging System (ELS) 163