Duplicate Logging

If a facility value is repeated in

syslog.conf

, for example:
user.debug /tmp/syslog_user_debug
user.alert /tmp/syslog_user_alert
The syslog daemon will log

user.debug

messages only to the

/tmp/syslog_user_debug

file while user.alert messages will be logged to both the

/tmp/syslog_user_debug

file and the

/tmp/syslog_user_alert

file. This is consistent
with the syslog design that logs the more severe conditions in multiple places.
Toprevent this duplicate logging, it is recommended that different facility values be
specified in the

syslog.conf

file. Atotal of 19 facility values are available.

Recurring Sequence Numbers in Syslog Output Files

Depending upon the configuration of your network, it is possible for duplicate UDP
packets containing ELS messages to arrive at the remote host. It is also possible
for the packets to arrive in a different order than they were transmitted. An example
of this phenomenon is shown in Figure 13. Notice that the messages with sequence
numbers 628 through 633 are logged twice. Also notice that after the first
occurrence of sequence number 0630, sequence number 0629 occurs again,
followed by the second occurrence of 0630.
Because neither Syslog nor UDP has the ability to handle duplicate or out of
sequence packets, it is important to recognize the possibility of duplicate sequence
numbers occurring.
Using ELS Message Buffering
Message buffering is an advanced feature of ELS that can help you with problem
determination. Youcan set up defaults that ELS will use for message buffering or
change how messages are buffered while the router is operating. Message buffering
can minimize the information lost because messages have wrapped in the default
message buffers. Message buffering is accessible through the advanced
configuration or monitoring command. It enables you to:
vSpecify whether buffering is active.
vSpecify what events are written to the message buffer.
vStop buffering and free the memory allocated for buffering.
vDisplay the status of the message buffer.
Apr 01 10:48:33 0.0.0.0 Msg [0628] from: RA22: : els: IPX.018: SAP gen rply sent nt 5 int TKR/1, 1 pkts
Apr 01 10:48:33 0.0.0.0 Msg [0628] from: RA22: : els: IPX.018: SAP gen rply sent nt 5 int TKR/1, 1 pkts
Apr 01 10:49:08 0.0.0.0 Msg [0629] from: RA22: : els: IPX.037: RIP resp sent nt 0 int TKR/0, 1 pkts
Apr 01 10:49:08 0.0.0.0 Msg [0630] from: RA22: : els: IPX.018: SAP gen rply sent nt 0 int TKR/0, 1 pkts
Apr 01 10:49:08 0.0.0.0 Msg [0629] from: RA22: : els: IPX.037: RIP resp sent nt 0 int TKR/0, 1 pkts
Apr 01 10:49:08 0.0.0.0 Msg [0630] from: RA22: : els: IPX.018: SAP gen rply sent nt 0 int TKR/0, 1 pkts
Apr 01 10:49:33 0.0.0.0 Msg [0631] from: RA22: : els: IPX.037: RIP resp sent nt 5 int TKR/1, 1 pkts
Apr 01 10:49:33 0.0.0.0 Msg [0631] from: RA22: : els: IPX.037: RIP resp sent nt 5 int TKR/1, 1 pkts
Apr 01 10:49:33 0.0.0.0 Msg [0632] from: RA22: : els: IPX.018: SAP gen rply sent nt 5 int TKR/1, 1 pkts
Apr 01 10:49:33 0.0.0.0 Msg [0632] from: RA22: : els: IPX.018: SAP gen rply sent nt 5 int TKR/1, 1 pkts
Apr 01 10:50:08 0.0.0.0 Msg [0633] from: RA22: : els: IPX.037: RIP resp sent nt 0 int TKR/0, 1 pkts
Apr 01 10:50:08 0.0.0.0 Msg [0633] from: RA22: : els: IPX.037: RIP resp sent nt 0 int TKR/0, 1 pkts
Figure 13. Example of Recurring Sequence Numbers in Syslog Output
Using ELS
Chapter12. Using the Event Logging System (ELS) 163
|
|
|
|
|
|
|
|
|
|
|
|
|