[c-nsp] Logs are empty

Thu May 14 19:49:53 EDT 2015

Thanks to everyone that responded.  Turns out there is a bug caused by "logging message-counter log | debug | syslog".  Bug id CSCut91867.  Slated to be fixed in 15.5.3M, July-August.  Hopefully this will save someone some headaches.

Sincerely,
Michael

------------------------------
Date: Thu, 14 May 2015 08:16:50 +0000
From: Nick Cutting <ncutting at edgetg.co.uk>
To: Karsten Thomann <karsten_thomann at linfre.de>,
        "cisco-nsp at puck.nether.net" <cisco-nsp at puck.nether.net>
Subject: Re: [c-nsp] Logs are empty
Message-ID:
        <DAE5489DEFDE014E882D054887E5F7533C09F460 at ETGLNEX01.edgetg.com>
Content-Type: text/plain; charset=WINDOWS-1252

Traffic transiting the router will not be logged without "debug ip packet", and also not logged unless you disable CEF and fast switching on the interface that is processing traffic.  This will make your router about 100 times slower.

i.e

interface FastEthernet0/1
 no ip route-cache cef
 no ip route-cache

Then check the IP parameters:
ROUTER#sh ip interface fa0/1
FastEthernet0/1 is up, line protocol is up
  ......
  IP fast switching is disabled
  IP fast switching on the same interface is disabled
  IP Flow switching is disabled
  IP CEF switching is disabled
  IP Fast switching turbo vector
  IP multicast fast switching is disabled
  .....

-----Original Message-----
From: cisco-nsp [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Karsten Thomann
Sent: 12 May 2015 23:18
To: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Logs are empty

Have you tried to use "logging buffered 128000 debugging"?
I know there is level debugging, but maybe it change the behavior...

Am Dienstag, 12. Mai 2015, 19:11:08 schrieb Michael Malitsky:
> sh run all produces the same output: " logging buffered 128000".  I
> thought debug was usually default... Sh log says " Buffer logging:
> level debugging"
> I did try logging buff info, no difference.  Until those 13 messages
> showed up, I thought logging was turned off completely, and "logging
> on" wasn't helping.
>
> Sincerely,
> Michael
>
> -----Original Message-----
> From: Randy [mailto:randy_94108 at yahoo.com]
> Sent: Tuesday, May 12, 2015 1:56 PM
> To: Michael Malitsky; Chuck Church
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Logs are empty
>
> Curious abut the default severity level for "logging buffered"? Sh run
> all should list. You could also try setting to logging buff info
>
> Regards,
> ./Randy
>
>
>
> ----- Original Message -----
> From: Michael Malitsky <malitsky at netabn.com>
> To: Chuck Church <chuckchurch at gmail.com>
> Cc: "cisco-nsp at puck.nether.net" <cisco-nsp at puck.nether.net>
> Sent: Tuesday, May 12, 2015 11:49 AM
> Subject: Re: [c-nsp] Logs are empty
>
> Correct, no syslog host configured yet.
>
> Sincerely,
> Michael
>
>
> Chuck Church <chuckchurch at gmail.com> wrote:
>
> Plus there were thousands of syslogs that were dropped.  I'm assuming
> because no hosts look to be configured?  Not sure they that's not
> getting to the buffer though.
>
> Chuck
>
> -----Original Message-----
> From: cisco-nsp [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf
> Of Michael Malitsky
> Sent: Tuesday, May 12, 2015 2:27 PM
> To: Lukas Tribus; cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Logs are empty
>
> True.  However, "logging monitor" plus "terminal monitor" change
> absolutely nothing.
>
> I do expect more messages in the buffer, especially after having
> debugs turned on, for traffic that I know is transiting the router.
> At least acknowledgements of configuration changes.  Something,
> besides messages incident to the router booting up.  BTW, these 13 did
> not show up until 3-4 hours after boot.
> Thanks
>
> Sincerely,
> Michael
>
> -----Original Message-----
> From: Lukas Tribus [mailto:luky-37 at hotmail.com]
> Sent: Tuesday, May 12, 2015 12:39 PM
> To: Michael Malitsky; cisco-nsp at puck.nether.net
> Subject: RE: [c-nsp] Logs are empty
>
> > Working with a brand new 2911, 15.4(3)M2. I can't get anything to
> > show up in the logs.
> > Neither monitor
>
> Which is disabled via "no logging monitor", so that should be expected?
>
> > nor buffer
>
> The "show logg" contains 13 messages from the buffer logging. Do you
> expect something else?
>
>
> Lukas
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

------------------------------

Subject: Digest Footer

_______________________________________________
cisco-nsp mailing list
cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp

------------------------------

End of cisco-nsp Digest, Vol 150, Issue 27
******************************************